Skip to content
OpenAdvisories

Vendor

flytohub

9 known vulnerabilities.

Products

flyto-core 9
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-67429

    Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)

    Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related file-writing modules use caller-controlled output_dir instead of validate_path_with_env_config and its FLYTO_SANDBOX_DIR confinement, allowin…

    flytohub flyto-core flyto-core PyPI
  • Critical 9.3
    CVE-2026-67426

    Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration

    Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the standalone flyto-verification service in src/core/verification_service.py exposes unauthenticated POST /run on 0.0.0.0:8344 and uses client-supplied callback_url fo…

    flytohub flyto-core flyto-core PyPI