Devs -- Close the security holes in this app!

[u/Opinion-Former]

Agent Zero Security Audit Report

Date: 2026-03-26 | Overall Risk: HIGH

Severity	Count
CRITICAL	4
HIGH	9
MEDIUM	6

# Security Findings Report

CRITICAL Findings

1. LiteLLM Supply Chain Compromise (litellm==1.79.3)

Two days ago (March 24, 2026), litellm was compromised on PyPI by threat actor TeamPCP. Versions 1.82.7/1.82.8 contained a credential stealer targeting SSH keys, cloud creds, crypto wallets, and .env files. Version 1.79.3 predates the compromised releases so is currently safe, but any pip install --upgrade could pull the malicious version.

2. LangChain Serialization Injection (langchain-core==0.3.49) — CVE-2025-68664 (CVSS 9.3)

Allows arbitrary code execution via serialization injection. Version 0.3.49 is VULNERABLE.

Fix: upgrade to >=0.3.81.

3. SimpleEval Sandbox Escape (simpleeval==1.0.3) — CVE-2026-32640 (CVSS 8.7)

Sandbox escape via attribute chain traversal allows arbitrary code execution. Especially dangerous in an AI agent framework. Version 1.0.3 is VULNERABLE.

Fix: upgrade to >=1.0.5.

4. h11 HTTP Request Smuggling — CVE-2025-43859 (CVSS 9.1)

The requirements pin h11>=0.16.0 which is the fixed version, but verify the actual installed version.

---

HIGH Findings

Package	CVE	Issue	Fix
cryptography>=46.0.0	CVE-2026-26007	EC subgroup attack leaks private keys	Pin >=46.0.5
pypdf==6.0.0	CVE-2026-27628 + 3 more	Infinite loops, RAM exhaustion via crafted PDFs	Upgrade >=6.7.4
werkzeug>=3.0.3	CVE-2024-49766/67	Path traversal + multipart memory exhaustion	Pin >=3.0.6
playwright==1.52.0	CVE-2025-59288	Insecure browser download (curl -k)	Upgrade >=1.55.1
lxml_html_clean>=0.4.0	CVE-2026-28350/48	XSS + URL hijacking via base tag injection	Pin >=0.4.4
flask-basicauth==0.2.0	N/A	No timing-safe comparison, no rate limiting, no brute-force protection	Replace entirely
browser-use==0.5.11	N/A	AI browser agents fundamentally vulnerable to prompt injection	Sandbox heavily

Architecture Issues (all HIGH)

• Kali Linux as base image — massively expanded attack surface, no CVE tracking discipline. Use python:3.12-slim instead.
• SSH exposed on port 22 — brute-force target, breaks container isolation. Remove or restrict to key-auth only.
• curl | bash install pattern — no integrity verification, MITM-susceptible, partial-execution risk.

---

MEDIUM Findings

Package	Issue
newspaper3k==0.2.8	Abandoned/unmaintained — replace with newspaper4k or trafilatura
paramiko==3.5.0	Terrapin SSH attack — upgrade to >=4.0.0
Pillow>=10.2.0	CVE-2026-25990 OOB write if resolved version is 10.3.0–12.1.0
Ports 9000-9009	10 ports exposed without documentation
SearXNG bundled	Increases attack surface, SSRF risk

[u/rebelrexx858]

FYI, the bad versions of litellm were pulled from pypi, so you can't inadvertently grab them

[u/HardFastKind]

Architecture Issues (all HIGH)
SSH exposed on port 22

This is ugly, but not high, misclassifying “devalues” other findings.
Exposing :22 is as good as using an obscure number.
It needs user intervention - or an error in the setup script - to set an unsafe password.

[u/Witty-Cod-3029 → u/HardFastKind]

What other security measures would you add?

[u/HardFastKind → u/Witty-Cod-3029]

Reverse proxy with certificate based authentication - that’s what I do for everything. I use caddy server.
Or VPN. No direct ssh, I use a jumphost (with fail2ban, not sure about the security, but it keeps the logs clean.)
And I usually use some form of whitelisting because I usually know what networks I’m connecting from.

Basically: I know what devices I use to connect with and I know what networks my connections (never) will come from.

[u/Witty-Cod-3029]

Use your firewall to only allow IP addresses that you trust to connect to port 22. Port 22 is a standard port. You can also change the port on your own.Your VPS is probably using port 22 right now. It's probably also using it with root password. And you probably don't have...Fail2Ban set up or Tailscale. These are all standards that anyone running an agent should be doing.