praisonai

vulnerable: 3.10.0 ... 4.6.9 (252 versions)

PraisonAI is a multi-agent teams system. In versions 3.9.26 through 4.6.57 of praiseonai and 0.12.12 through 1.6.57 of praiseonaiagents, the workflow "include" feature is vulnerable to code execution. Workflow._execute_include() implicitly…

vulnerable: 0.0.1 ... 4.6.9 (748 versions)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream _validate_origin method accepts request_origin.startswith(allowed), so the attacker-controlled localhost.evil.example HTTP origin matches the localhost…

vulnerable: 0.0.1 ... 4.6.9 (748 versions)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream mcp_post handler creates a new _sessions entry for every initialize request but does not call _cleanup_sessions or enforce a maximum. An unauthenticate…

vulnerable: 0.0.1 ... 4.6.9 (748 versions)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream _validate_origin uses request_origin.startswith(allowed), allowing the attacker-controlled localhost.attacker.com HTTP origin to satisfy the localhost allo…

vulnerable: 0.0.1 ... 4.6.9 (748 versions)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, create_auth_middleware() allows requests when auth=api-key lacks PRAISONAI_API_KEY or JWT authentication lacks PRAISONAI_JWT_SECRET. An externally bound Recipe server can …

vulnerable: 4.6.34 ... 4.6.57 (23 versions)

PraisonAI is a multi-agent teams system. From praisonai 4.6.34 until 4.6.58, praisonai serve agents accepts --api-key but _create_agents_app() does not authenticate POST /agents or POST /agents/{agent_name}. A network caller can invoke con…

vulnerable: 0.0.1 ... 4.6.9 (748 versions)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the Jobs API validate_webhook_url() path fails open on socket.gaierror and does not bind the validated address to the later request. An attacker webhook_url can later reso…

vulnerable: 0.0.1 ... 4.6.9 (748 versions)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server _handle_connection() checks Chrome extension origins with re.match() and the unanchored expression chrome-extension://[a-z0-9]{32}. Extra trailing character…

vulnerable: 0.0.1 ... 4.6.9 (748 versions)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, JobSubmitRequest.validate_webhook_url() accepts webhook_url when resolution raises socket.gaierror because the exception path uses except socket.gaierror: pass. JobExecuto…

vulnerable: 0.0.1 ... 4.6.9 (748 versions)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, praisonai serve agents parses config["api_key"] but _create_agents_app() does not authenticate POST /agents or POST /agents/{agent_name}. Missing or incorrect bearer and X…

vulnerable: 0.0.1 ... 4.6.9 (748 versions)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, the Jobs API create_app function mounts /api/v1/runs without authentication. Any reachable caller can submit jobs, read results, cancel runs, or delete jobs using operator…

vulnerable: 0.0.1 ... 4.6.9 (748 versions)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, is_path_within_directory() uses os.path.abspath() rather than os.path.realpath() for the workspace boundary. A symlink inside workspace can point outside and still pass th…

vulnerable: 0.0.1 ... 4.6.9 (748 versions)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, praisonai serve agents and praisonai serve unified parse --api-key but _create_agents_app() and _create_unified_app() do not install a credential check. Unauthenticated ca…

vulnerable: 0.0.1 ... 4.5.98 (685 versions)

PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI modules hardcode approval_mode to auto, overriding administrator configuration from PRAISON_APPROVAL_MODE environment variable. Authenticated…

vulnerable: 4.5.10 ... 4.6.9 (176 versions)

PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals # DiscordApproval accepts unrelated channel messages as dangerous-tool approvals ## Summary `praisonai.bots.DiscordApproval` approves a pending dan…

vulnerable: 3.10.0 ... 4.6.9 (300 versions)

PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal # PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal ## Summary Pra…

vulnerable: 3.10.0 ... 4.6.9 (300 versions)

PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage # PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage ## Summary PraisonAI's Dynamic Context Discovery f…

vulnerable: 3.11.0 ... 4.6.9 (215 versions)

PraisonAI Slack app_mention bypasses configured user/channel authorization # PraisonAI Slack `app_mention` bypasses configured user/channel authorization ## Summary PraisonAI's Slack bot applies its configured `allowed_users`, `allowed_…

vulnerable: 4.5.112 ... 4.6.9 (79 versions)

PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard # PraisonAI `recipe serve` Typer command bypasses the non-localhost authentication guard ## Summary PraisonAI's installed console entrypoint is Typer-f…

vulnerable: 4.6.56, 4.6.57, 4.6.58

PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing # PraisonAI LinearBot processes unsigned webhooks when `LINEAR_WEBHOOK_SECRET` is missing ## Summary PraisonAI's LinearBot starts a public webhook lis…

vulnerable: 4.5.100 ... 4.6.9 (101 versions)

PraisonAI recipe.run_stream skips dangerous-tool policy enforcement # PraisonAI `recipe.run_stream()` skips dangerous-tool policy enforcement ## Summary PraisonAI recipe execution blocks default-denied dangerous tools unless the caller …

vulnerable: 0.0.1 ... 4.6.9 (749 versions)

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the CODE_TOOLS wrappers keep _workspace_root as None and pass workspace=None to read_file, search_replace, and apply_diff helpers that enforce path containment only for a truthy wor…

vulnerable: 4.5.10 ... 4.6.9 (176 versions)

PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools # HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools…

vulnerable: 3.10.0 ... 4.6.9 (243 versions)

PraisonAI is a multi-agent teams system. From praisonaiagents 0.6.0 until 1.6.59 and PraisonAI 3.10.0 until 4.6.59, ToolsMCPServer.run_sse() in src/praisonai-agents/praisonaiagents/mcp/mcp_server.py mounts SseServerTransport on the legacy …

vulnerable: 2.6.0 ... 4.6.9 (370 versions)

PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion ## Summary PraisonAI's template loader accepts GitHub template URIs with refs, for example `github:owner/repo/[email protected]`. The res…

vulnerable: 4.5.126 ... 4.6.9 (66 versions)

PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding # Jobs webhook SSRF protection bypass via DNS rebinding ## Summary PraisonAI's Async Jobs API validates `webhook_url` when a job request is parsed and again when the inter…

vulnerable: 4.2.1 ... 4.6.9 (196 versions)

PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation # AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation ## Summary PraisonAI's `Agen…

vulnerable: 4.6.10 ... 4.6.58 (47 versions)

PraisonAI: Compute-bridged file tools allow shell command injection # Compute-bridged file tools allow shell command injection ## Summary `LocalManagedAgent` / `SandboxedAgent` compute bridging wraps `read_file`, `list_files`, and `writ…

vulnerable: 0.0.1 ... 4.6.9 (749 versions)

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the unauthenticated Jobs API accepts an absolute or traversing agent_file path in POST /api/v1/runs and passes it to the job executor without a workspace allowlist or boundary check…

vulnerable: 0.0.1 ... 4.6.9 (749 versions)

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPP_APP_SECRET or LINEAR_WEBHOOK_SECRET is configured and otherwise parse and dispatch unsigned re…

vulnerable: 0.0.1 ... 4.6.9 (749 versions)

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioM…

vulnerable: 0.0.1 ... 4.6.9 (749 versions)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.59 and praisonaiagents 1.6.59, the unauthenticated POST /api/v1/runs Jobs API accepts attacker-controlled agent_yaml, and the approve field can mark execute_command as YAML-ap…

vulnerable: 0.0.1 ... 4.6.9 (749 versions)

PraisonAI is a multi-agent teams system. Prior to 4.6.58, recipe serve installs APIKeyAuthMiddleware or JWTAuthMiddleware when an operator selects api-key or JWT authentication, but each middleware forwards requests when PRAISONAI_API_KEY …

vulnerable: 0.0.1 ... 4.6.9 (749 versions)

PraisonAI is a multi-agent teams system. Prior to 4.6.58, praisonai.jobs.server.create_app mounts praisonai.jobs.router.create_router under /api/v1/runs without authentication or per-job authorization. Network clients can submit attacker-c…

vulnerable: 0.0.1 ... 4.6.9 (751 versions)

PraisonAI is a multi-agent teams system. Prior to 4.6.62, setting PRAISONAI_CALL_AUTH to disabled makes verify_token accept requests to /api/v1/agents/{id}/invoke without CALL_SERVER_TOKEN authentication. Deployments that use the applicati…

vulnerable: 4.5.100 ... 4.6.9 (103 versions)

PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml ## Summary PraisonAI recipe execution has a dangerous-tool policy that is supposed to block default-denied tools unles…

vulnerable: 4.5.110 ... 4.6.9 (83 versions)

PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable ## Summary `praisonai.sandbox.SandlockSandbox` is documented and implemented as the kernel-enforced sandbox backend for untrusted code…

vulnerable: 0.0.1 ... 4.6.9 (751 versions)

PraisonAI is a multi-agent teams system. Prior to 4.6.62, src/praisonai/praisonai/tools/multiedit.py passes the LLM-controlled filepath parameter directly to open for reading and writing without traversal rejection, symlink resolution, a w…

vulnerable: 4.5.115 ... 4.6.9 (78 versions)

PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default ## Summary The published A2U advisory `GHSA-f292-66h9-fpmf` says unauthenticated A2U event streaming was fixed in `praisonai` `4.5.115`. …

vulnerable: 0.0.1 ... 4.6.9 (731 versions)

Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absolute filesystem paths by supplying a crafted tar archive with a SYMTYPE entry …