HIGHCVSS 8.7
GHSA-j659-8xh6-5pq5
atomic-agents-stack: Parallel helper/delegate batch reserves $0 for models absent from the pricing table, bypassing the cost-cap fan-out guard
Summary
`_estimate_batch_cost` (`atomic_agents/agent.py`) looks up the per-model output price with `PRICING.get(model, {})`, returning 0.0 for any model not in the hardcoded pricing table. `_check_batch_reservation` then early-returns when the reservation is 0 and that an over-cap unknown-model batch raises `CostGuardrailBlocked`.
Affected packages
| Ecosystem | Package | Affected versions | Fixed versions |
|---|---|---|---|
| PyPI | atomic-agents-stack | — | 1.1.0 |
Remediation: Upgrade to 1.1.0 or later.
References
Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.