Skip to content
OpenAdvisories

Vendor

jaylfc

2 known vulnerabilities.

Products

taOS 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.8
    CVE-2026-67547

    taOS: Authenticated Non-Admin Host Code Execution via Skill Runtime

    taOS is a self-hosted AI agent OS. Prior to version 1.0.0-beta.23, the POST /api/skill-exec/{skill_id}/call endpoint in taOS executes built-in skills — including the code_exec skill which runs arbitrary Python via subprocess.run(["python3", "-c", code]) — wit…

    jaylfc taOS
  • High 8.3
    CVE-2026-67548

    taOS: Non-Admin Users Can Access System Settings and Update Actions

    taOS is a self-hosted AI agent OS. Prior to version 1.0.0-beta.25, tinyagentos (taOS) registers all system settings routes under a single APIRouter() instance created with no admin authorization dependency. Any authenticated user—including non-admin invited u…

    jaylfc taOS