taOS vulnerabilities

2 known vulnerabilities in taOS from Jaylfc. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.3 High severity

  taOS: Missing Authorization

  CVE-2026-67548Nov 11, 2026Jaylfc

  taOS is a self-hosted AI agent OS. Prior to version 1.0.0-beta.25, tinyagentos (taOS) registers all system settings routes under a single APIRouter() instance created with no admin authorization dependency. Any authenticated user—including non-admin invited us

• 8.8 High severity

  taOS: Missing Authorization

  CVE-2026-67547Nov 11, 2026Jaylfc

  taOS is a self-hosted AI agent OS. Prior to version 1.0.0-beta.23, the POST /api/skill-exec/{skill_id}/call endpoint in taOS executes built-in skills — including the code_exec skill which runs arbitrary Python via subprocess.run(["python3", "-c", code]) — with