Skip to content
OpenAdvisories

Package · PyPI

atomic-agents-stack

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 7.5
    CVE-2026-91989

    atomic-agents-stack before 1.1.0 Path Traversal via dashboard serve.py

    atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the dashboard HTTP server that allows remote attackers to read arbitrary files by supplying directory traversal sequences in request paths. Attackers can bypass path containment check…

    dep0we atomic-agents-stack atomic-agents-stack PyPI
  • High 8.1
    CVE-2026-91988

    atomic-agents-stack before 1.1.0 Remote Code Execution via HTTP MCP

    atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers to rewrite catalog responses. Attackers can inject arbitrary command and argument values that are spa…

    dep0we atomic-agents-stack atomic-agents-stack PyPI
  • Medium 6.5
    CVE-2026-91987

    atomic-agents-stack before 1.1.0 Cost Guardrail Bypass via Unknown Model

    atomic-agents-stack before 1.1.0 contains a cost-guardrail bypass in the _estimate_batch_cost function that returns zero cost for unknown models not in the pricing table. Attackers can configure deployments with unknown model identifiers to bypass daily cost …

    dep0we atomic-agents-stack atomic-agents-stack PyPI