Finding 6 CVEs in Open-Source AI Tools with Apiiro AI-SAST

Apiiro AI-SAST surfaced and validated six real CVEs across PraisonAI and SiYuan — detection at scale, agentic triage over the Software Graph, and context-aware AutoFix remediation.

Research

Published July 30 2026 · 8 min. read

AI is writing more code, across more repos, than any review process was built to handle, and a lot of that code now comprises the AI tooling everyone else builds on. We wanted to see what [Apiiro AI-SAST](https://apiiro.com/blog/apiiro-ai-sast-the-first-risk-validation-engine-for-the-ai-era-of-software-development) would surface when we pointed it at those projects, and whether the findings held up as real, exploitable vulnerabilities. AI-SAST handled detection and triage, reasoning over the Software Graph to decide which candidates were reachable and worth a closer look, and we confirmed the survivors by hand with working proof-of-concepts. We scanned a set of projects across the ecosystem and went deep on two of them. **Six findings held up as CVEs.** ## The setup Legacy SAST hands you a firehose, providing thousands of raw findings with little to indicate which pose the most risk. A reviewer working through that volume spends most of the time discarding noise. Apiiro AI-SAST is built to change where that effort goes, moving from raw detection to risk validation and remediation, and applying the reasoning an experienced application security engineer would use, automated and continuous at enterprise scale. The enterprise-scale component is important for this research. Apiiro AI-SAST is built with enterprise codebases in mind, but it isn't only useful there. Our goal was to point it "upstream," at the open-source tools that many enterprises depend on. AI-SAST is built in two layers: - **Detection** uses the AST advantage as a lead generator, fast and deterministic scanning across millions of lines of code for structural flaws. This layer runs on Deep Code Analysis (DCA), Apiiro's proprietary technology that orchestrates multiple deterministic and non-deterministic engines, including open-source Semgrep, so the candidate set is far wider than any single ruleset would produce. - **Triage and Fix** uses LLMs and an agentic harness to add semantic reasoning (the intent, naming, and logic flow) to validate a candidate, prioritize it, and fix it. This layer is powered by commercial frontier models, operated by Apiiro's own agents. Both layers draw on the same foundation, Apiiro's [AppSec Data Fabric](https://apiiro.com/platform). Deep Code Analysis maps the application before anything is scored, building an extended inventory of every API, OSS dependency, internal package, AI model, data model, and secret, and classifying the technology stack across more than 750 categories spanning authentication, authorization, encryption, data access, and AI. AI-SAST is what turns raw volume into something a person can act on. It lets the triage layer answer the questions that decide whether a flagged line is real: - Can an attacker reach this code from a real entry point? - Does untrusted input arrive at the sink intact? - Can an unauthenticated user trigger it, and if it fires, what is the blast radius? These are the questions a good reviewer asks, and the Data Fabric is what lets AI-SAST answer them from the code instead of guessing. The result is a short list of validated findings with a rationale for each, a few dozen to read rather than a few thousand. Without that context, the same exercise means re-deriving the architecture by hand for every candidate, which is where this kind of review usually stalls. We examined two projects from the AI-tooling ecosystem: **PraisonAI**, a multi-agent framework, and **SiYuan**, an Electron knowledge base with a plugin marketplace. Both are fast-moving projects where the pressure to ship outruns the time to review. Everything below survived validation via Apiiro AI-SAST, and has since been disclosed and fixed. ## The findings  ### PraisonAI: What happens when an agent framework trusts its own inputs Agent frameworks are built to act, running tools, executing code, and reaching into databases on a developer's behalf, so every input they trust is somewhere an attacker can act too. AI-SAST surfaced three such inputs in PraisonAI. **1. CVE-2026-44339. Undeclared callables get executed (CVSS 8.6 per GitHub (CNA)).** When the tool executor can't match a requested tool name, it falls back to looking it up in the global namespace: ```python if func is None: func = globals().get(function_name) if not func: import __main__ func = getattr(__main__, function_name, None) ``` The declared tool list is supposed to be the security boundary, but the default permission setting is `_perm_allow = None` — allow everything. So a callable name an attacker supplies in a tool call gets resolved out of `globals()` or `__main__` and invoked, with nothing on the allow-list to stop it. That's arbitrary callable invocation; whether it reaches full remote code execution depends on which callables are reachable in the running process. **2. CVE-2026-44338. The API server ships with auth off (CVSS 7.3 per GitHub (CNA)).** The bundled legacy API server hardcodes `AUTH_ENABLED = False`, and `check_auth()` returns `True` whenever auth is disabled, so the protected routes fail open by design. Launch it directly and it binds `0.0.0.0:8080`. Any unauthenticated caller on the network can then enumerate agents via `GET /agents` and trigger workflows via `POST /chat`. **3. CVE-2026-44337. Collection names go straight into SQL (CVSS 6.3 per GitHub (CNA)).** The knowledge-store backends interpolate caller-supplied collection names directly into query text: ```python f"{self.table_prefix}{name}" # name is never quoted or validated ``` There is no quoting and no parameterization, across the SingleStore, pgvector, and Cassandra backends, so a collection name becomes an injection point. None of these are exotic; they are the ordinary mistakes that show up when code ships fast, and AI-assisted development produces a great deal more of it, a great deal faster. ### Rapid exploitation in the wild Attackers attempted to exploit CVE-2026-44338 within hours of its disclosure. The speed of exploitation was significant enough to earn [press coverage](https://thehackernews.com/2026/05/praisonai-cve-2026-44338-auth-bypass.html), but beyond that points to an alarming question: even when threat research covers all its bases, and discloses diligently, attackers can still snatch a 3-hour window: more than enough time to run an exploit. > This further emphasizes the importance of automatically remediating vulnerabilities with context-aware, build-safe fixes. This capability, AutoFix, is a core pillar of Apiiro Guardian. ### SiYuan: One root cause, three ways in SiYuan is an Electron app, and it runs its renderer with `nodeIntegration: true` and `contextIsolation: false`. In that configuration, any JavaScript running in the renderer can reach `require('child_process')`, which turns a stored XSS into arbitrary code execution on the host machine rather than a harmless popup. That change in scope, from browser context to host, is what makes these Critical. AI-SAST surfaced three separate sinks where user-controlled content reaches the DOM as raw HTML. Because SiYuan syncs workspace content between a user's devices, a payload propagates to nearly every peer and fires the next time the victim views the affected content; for CSS snippets, on load, with no interaction at all: - **CVE-2026-54158 (Critical, CVSS 9.9 per GitHub (CNA)).** `genAVValueHTML()` renders attribute-view cells (text, url, phone, Masset) unescaped. A payload like ` ` breaks out and runs when the victim opens the block-attribute panel. - **CVE-2026-54067 (Critical, CVSS 9.9 per GitHub (CNA)).** CSS snippets are inserted via `insertAdjacentHTML()`, so a ` ` in the snippet body breaks out of the style tag into live markup. Because snippets are applied on load, this one fires with no interaction at all. - **CVE-2026-44586 (CVSS 8.3 per GitHub (CNA)).** This payload arrives via the public bazaar stage feed, not workspace sync. The Bazaar marketplace renders a package's `author` field via `innerHTML` without escaping. A malicious plugin submission carries the payload, which runs when a victim browses the marketplace. In an Electron app with `nodeIntegration` on, one XSS→RCE sink almost always has siblings. Once the first unescaped `innerHTML` on untrusted data surfaced, the rest was enumeration; the exhaustive, repetitive variant-hunting that manual review often leaves half-finished, and that the detection layer handles well. That is how AI-SAST turned one lead into three high and critical findings in a single app. ## How Guardian Agent makes it possible This experiment is the manual version of what [Guardian Agent](https://apiiro.com/product) does continuously, as actions on top of the [AppSec Data Fabric](https://apiiro.com/platform): - **AI-SAST runs continuously**, instead of in a single research push, as in this example. Detection generates every lead deterministically, and the triage layer reasons over the Software Graph like a virtual researcher, confirming true positives and dismissing false positives with evidence. - **AutoFix closes what detection confirms.** In production customers' environments where Guardian is able to act on the code, the next phase after detection is automated fixing. [AutoFix](https://apiiro.com/product/guardian-agent/autofix) traces each confirmed finding (sourced, for example, from Apiiro's AI-SAST, AI-SCA, Secrets or any other 3rd party scanner existing in our customers' environments) to its root cause and produces a context-aware, build-safe fix PR, delivered in bulk for AppSec teams or sent to developers' coding agents. In production it closes findings about as fast as they are validated. [Get a demo](https://apiiro.com/demo) to see how Guardian Agent finds and triages real risk across your code. --- **Disclosure:** All six CVEs were reported through GitHub Security Advisories and coordinated with maintainers before publication. CVE-2026-44337 / 44338 / 44339 (PraisonAI) and CVE-2026-44586 (SiYuan) were reported by @shmulc8; CVE-2026-54158 and CVE-2026-54067 (SiYuan) by @hillalee.

Shmulik Cohen