Homepage

atomic-agents-stack@1.0.0

Spec + reference implementation for vault-native, multi-runtime AI agents

  • latest version

    2.0.0

  • latest non vulnerable version

    2.0.0

  • first published

    4 months ago

  • latest version published

    4 months ago

  • licenses detected

  • View atomic-agents-stack package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the atomic-agents-stack package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Allocation of Resources Without Limits or Throttling

    atomic-agents-stack is a Spec + reference implementation for vault-native, multi-runtime AI agents

    Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to improper handling of unknown models in the PRICING lookup within the _estimate_batch_cost function. An attacker can bypass configured cost caps by submitting parallel batch requests with models absent from the pricing table, causing the system to reserve $0 and skip the intended cost guardrails.

    How to fix Allocation of Resources Without Limits or Throttling?

    Upgrade atomic-agents-stack to version 1.1.0 or higher.

    [,1.1.0)
    • H
    Directory Traversal

    atomic-agents-stack is a Spec + reference implementation for vault-native, multi-runtime AI agents

    Affected versions of this package are vulnerable to Directory Traversal via the DashboardHandler.do_GET process in the dashboard HTTP server, which constructs filesystem paths from user-supplied request paths without proper containment checks. An attacker can access arbitrary files outside the intended directory by sending specially crafted requests containing ../ path segments. This is only exploitable if the dashboard HTTP server is enabled and bound to a network-accessible interface or if DNS rebinding or SSRF is possible.

    How to fix Directory Traversal?

    Upgrade atomic-agents-stack to version 1.1.0 or higher.

    [,1.1.0)
    • H
    Resources Downloaded over Insecure Protocol

    atomic-agents-stack is a Spec + reference implementation for vault-native, multi-runtime AI agents

    Affected versions of this package are vulnerable to Resources Downloaded over Insecure Protocol via the make_http_mcp_server_registry_backend_from_url process. An attacker can execute arbitrary commands on the host by performing a man-in-the-middle attack on cleartext HTTP connections to inject malicious command or args values into the catalog response.

    How to fix Resources Downloaded over Insecure Protocol?

    Upgrade atomic-agents-stack to version 1.1.0 or higher.

    [,1.1.0)
    Go back to all versions of this package