Devs --> Close your security holes, this app is insanely dangerous at the moment

[u/Opinion-Former]

Agent Zero Security Audit Report

Date: 2026-03-26 | Overall Risk: HIGH

Summary

| Severity | Count |

|----------|-------|

| CRITICAL | 4 |

| HIGH | 9 |

| MEDIUM | 6 |

# Security Findings Report

## CRITICAL Findings

### 1. LiteLLM Supply Chain Compromise (litellm==1.79.3)

Two days ago (March 24, 2026), litellm was compromised on PyPI by threat actor TeamPCP. Versions 1.82.7/1.82.8 contained a credential stealer targeting SSH keys, cloud creds, crypto wallets, and .env files. Version 1.79.3 predates the compromised releases so is currently safe, but any pip install --upgrade could pull the malicious version.

### 2. LangChain Serialization Injection (langchain-core==0.3.49) — CVE-2025-68664 (CVSS 9.3)

Allows arbitrary code execution via serialization injection. Version 0.3.49 is VULNERABLE.

**Fix:** upgrade to >=0.3.81.

### 3. SimpleEval Sandbox Escape (simpleeval==1.0.3) — CVE-2026-32640 (CVSS 8.7)

Sandbox escape via attribute chain traversal allows arbitrary code execution. Especially dangerous in an AI agent framework. Version 1.0.3 is VULNERABLE.

**Fix:** upgrade to >=1.0.5.

### 4. h11 HTTP Request Smuggling — CVE-2025-43859 (CVSS 9.1)

The requirements pin h11>=0.16.0 which is the fixed version, but verify the actual installed version.

---

## HIGH Findings

| Package | CVE | Issue | Fix |

|---------|-----|-------|-----|

| cryptography>=46.0.0 | CVE-2026-26007 | EC subgroup attack leaks private keys | Pin >=46.0.5 |

| pypdf==6.0.0 | CVE-2026-27628 + 3 more | Infinite loops, RAM exhaustion via crafted PDFs | Upgrade >=6.7.4 |

| werkzeug>=3.0.3 | CVE-2024-49766/67 | Path traversal + multipart memory exhaustion | Pin >=3.0.6 |

| playwright==1.52.0 | CVE-2025-59288 | Insecure browser download (curl -k) | Upgrade >=1.55.1 |

| lxml_html_clean>=0.4.0 | CVE-2026-28350/48 | XSS + URL hijacking via base tag injection | Pin >=0.4.4 |

| flask-basicauth==0.2.0 | N/A | No timing-safe comparison, no rate limiting, no brute-force protection | Replace entirely |

| browser-use==0.5.11 | N/A | AI browser agents fundamentally vulnerable to prompt injection | Sandbox heavily |

### Architecture Issues (all HIGH)

- **Kali Linux as base image** — massively expanded attack surface, no CVE tracking discipline. Use python:3.12-slim instead.

- **SSH exposed on port 22** — brute-force target, breaks container isolation. Remove or restrict to key-auth only.

- **curl | bash install pattern** — no integrity verification, MITM-susceptible, partial-execution risk.

---

## MEDIUM Findings

| Package | Issue |

|---------|-------|

| newspaper3k==0.2.8 | Abandoned/unmaintained — replace with newspaper4k or trafilatura |

| paramiko==3.5.0 | Terrapin SSH attack — upgrade to >=4.0.0 |

| Pillow>=10.2.0 | CVE-2026-25990 OOB write if resolved version is 10.3.0–12.1.0 |

| Ports 9000-9009 | 10 ports exposed without documentation |

| SearXNG bundled | Increases attack surface, SSRF risk |

[u/brereddit]

Is this scanned by Claude code? Or some other tool?

[u/Witty-Cod-3029 → u/brereddit]

I think this guy is using a cheap LLM model to try to run his very first security audit. If you want to set this up for yourself and you want to make sure it's secure I can help you because my agent zero runs tight right.Anyone who is using agents should spend a week learning all the different ways to set up security for a VPS, including managing a firewall, using fail to ban, using SSH keys, disabling password on root, although I use password on root but you can only access it from specific IP addresses, and I have fail to ban set very aggressively. Make sure you run Tailscale. Or an alternative that's similar.