praisonai

vulnerable: 3.10.0 ... 4.6.9 (252 versions)

PraisonAI is a multi-agent teams system. In versions 3.9.26 through 4.6.57 of praiseonai and 0.12.12 through 1.6.57 of praiseonaiagents, the workflow "include" feature is vulnerable to code execution. Workflow._execute_include() implicitly…

vulnerable: 0.0.1 ... 4.6.9 (748 versions)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream _validate_origin method accepts request_origin.startswith(allowed), so the attacker-controlled localhost.evil.example HTTP origin matches the localhost…

vulnerable: 0.0.1 ... 4.6.9 (748 versions)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream mcp_post handler creates a new _sessions entry for every initialize request but does not call _cleanup_sessions or enforce a maximum. An unauthenticate…

vulnerable: 0.0.1 ... 4.6.9 (748 versions)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream _validate_origin uses request_origin.startswith(allowed), allowing the attacker-controlled localhost.attacker.com HTTP origin to satisfy the localhost allo…

vulnerable: 0.0.1 ... 4.6.9 (748 versions)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, create_auth_middleware() allows requests when auth=api-key lacks PRAISONAI_API_KEY or JWT authentication lacks PRAISONAI_JWT_SECRET. An externally bound Recipe server can …

vulnerable: 4.6.34 ... 4.6.57 (23 versions)

PraisonAI is a multi-agent teams system. From praisonai 4.6.34 until 4.6.58, praisonai serve agents accepts --api-key but _create_agents_app() does not authenticate POST /agents or POST /agents/{agent_name}. A network caller can invoke con…

vulnerable: 0.0.1 ... 4.6.9 (748 versions)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the Jobs API validate_webhook_url() path fails open on socket.gaierror and does not bind the validated address to the later request. An attacker webhook_url can later reso…

vulnerable: 0.0.1 ... 4.6.9 (748 versions)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server _handle_connection() checks Chrome extension origins with re.match() and the unanchored expression chrome-extension://[a-z0-9]{32}. Extra trailing character…

vulnerable: 0.0.1 ... 4.6.9 (748 versions)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, JobSubmitRequest.validate_webhook_url() accepts webhook_url when resolution raises socket.gaierror because the exception path uses except socket.gaierror: pass. JobExecuto…

vulnerable: 0.0.1 ... 4.6.9 (748 versions)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, praisonai serve agents parses config["api_key"] but _create_agents_app() does not authenticate POST /agents or POST /agents/{agent_name}. Missing or incorrect bearer and X…

vulnerable: 0.0.1 ... 4.6.9 (748 versions)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, the Jobs API create_app function mounts /api/v1/runs without authentication. Any reachable caller can submit jobs, read results, cancel runs, or delete jobs using operator…

vulnerable: 0.0.1 ... 4.6.9 (748 versions)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, is_path_within_directory() uses os.path.abspath() rather than os.path.realpath() for the workspace boundary. A symlink inside workspace can point outside and still pass th…

vulnerable: 0.0.1 ... 4.6.9 (748 versions)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, praisonai serve agents and praisonai serve unified parse --api-key but _create_agents_app() and _create_unified_app() do not install a credential check. Unauthenticated ca…

vulnerable: 0.0.1 ... 4.5.98 (685 versions)

PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI modules hardcode approval_mode to auto, overriding administrator configuration from PRAISON_APPROVAL_MODE environment variable. Authenticated…

vulnerable: 4.5.10 ... 4.6.9 (176 versions)

PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals # DiscordApproval accepts unrelated channel messages as dangerous-tool approvals ## Summary `praisonai.bots.DiscordApproval` approves a pending dan…

vulnerable: 3.10.0 ... 4.6.9 (300 versions)

PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal # PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal ## Summary Pra…

vulnerable: 3.10.0 ... 4.6.9 (300 versions)

PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage # PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage ## Summary PraisonAI's Dynamic Context Discovery f…

vulnerable: 3.11.0 ... 4.6.9 (215 versions)

PraisonAI Slack app_mention bypasses configured user/channel authorization # PraisonAI Slack `app_mention` bypasses configured user/channel authorization ## Summary PraisonAI's Slack bot applies its configured `allowed_users`, `allowed_…

vulnerable: 4.5.112 ... 4.6.9 (79 versions)

PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard # PraisonAI `recipe serve` Typer command bypasses the non-localhost authentication guard ## Summary PraisonAI's installed console entrypoint is Typer-f…

vulnerable: 4.6.56, 4.6.57, 4.6.58

PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing # PraisonAI LinearBot processes unsigned webhooks when `LINEAR_WEBHOOK_SECRET` is missing ## Summary PraisonAI's LinearBot starts a public webhook lis…

vulnerable: 4.5.100 ... 4.6.9 (101 versions)

PraisonAI recipe.run_stream skips dangerous-tool policy enforcement # PraisonAI `recipe.run_stream()` skips dangerous-tool policy enforcement ## Summary PraisonAI recipe execution blocks default-denied dangerous tools unless the caller …

vulnerable: 0.0.1 ... 4.6.9 (749 versions)

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the CODE_TOOLS wrappers keep _workspace_root as None and pass workspace=None to read_file, search_replace, and apply_diff helpers that enforce path containment only for a truthy wor…

vulnerable: 4.5.10 ... 4.6.9 (176 versions)

PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools # HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools…

vulnerable: 3.10.0 ... 4.6.9 (243 versions)

PraisonAI is a multi-agent teams system. From praisonaiagents 0.6.0 until 1.6.59 and PraisonAI 3.10.0 until 4.6.59, ToolsMCPServer.run_sse() in src/praisonai-agents/praisonaiagents/mcp/mcp_server.py mounts SseServerTransport on the legacy …

vulnerable: 2.6.0 ... 4.6.9 (370 versions)

PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion ## Summary PraisonAI's template loader accepts GitHub template URIs with refs, for example `github:owner/repo/[email protected]`. The res…

vulnerable: 4.5.126 ... 4.6.9 (66 versions)

PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding # Jobs webhook SSRF protection bypass via DNS rebinding ## Summary PraisonAI's Async Jobs API validates `webhook_url` when a job request is parsed and again when the inter…

vulnerable: 4.2.1 ... 4.6.9 (196 versions)

PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation # AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation ## Summary PraisonAI's `Agen…

vulnerable: 4.6.10 ... 4.6.58 (47 versions)

PraisonAI: Compute-bridged file tools allow shell command injection # Compute-bridged file tools allow shell command injection ## Summary `LocalManagedAgent` / `SandboxedAgent` compute bridging wraps `read_file`, `list_files`, and `writ…

vulnerable: 0.0.1 ... 4.6.9 (749 versions)

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the unauthenticated Jobs API accepts an absolute or traversing agent_file path in POST /api/v1/runs and passes it to the job executor without a workspace allowlist or boundary check…

vulnerable: 0.0.1 ... 4.6.9 (749 versions)

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPP_APP_SECRET or LINEAR_WEBHOOK_SECRET is configured and otherwise parse and dispatch unsigned re…

vulnerable: 0.0.1 ... 4.6.9 (749 versions)

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioM…

vulnerable: 0.0.1 ... 4.6.9 (749 versions)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.59 and praisonaiagents 1.6.59, the unauthenticated POST /api/v1/runs Jobs API accepts attacker-controlled agent_yaml, and the approve field can mark execute_command as YAML-ap…

vulnerable: 0.0.1 ... 4.6.9 (749 versions)

PraisonAI is a multi-agent teams system. Prior to 4.6.58, recipe serve installs APIKeyAuthMiddleware or JWTAuthMiddleware when an operator selects api-key or JWT authentication, but each middleware forwards requests when PRAISONAI_API_KEY …

vulnerable: 0.0.1 ... 4.6.9 (749 versions)

PraisonAI is a multi-agent teams system. Prior to 4.6.58, praisonai.jobs.server.create_app mounts praisonai.jobs.router.create_router under /api/v1/runs without authentication or per-job authorization. Network clients can submit attacker-c…

vulnerable: 0.0.1 ... 4.6.9 (751 versions)

PraisonAI is a multi-agent teams system. Prior to 4.6.62, setting PRAISONAI_CALL_AUTH to disabled makes verify_token accept requests to /api/v1/agents/{id}/invoke without CALL_SERVER_TOKEN authentication. Deployments that use the applicati…

vulnerable: 4.5.100 ... 4.6.9 (103 versions)

PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml ## Summary PraisonAI recipe execution has a dangerous-tool policy that is supposed to block default-denied tools unles…

vulnerable: 4.5.110 ... 4.6.9 (83 versions)

PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable ## Summary `praisonai.sandbox.SandlockSandbox` is documented and implemented as the kernel-enforced sandbox backend for untrusted code…

vulnerable: 0.0.1 ... 4.6.9 (751 versions)

PraisonAI is a multi-agent teams system. Prior to 4.6.62, src/praisonai/praisonai/tools/multiedit.py passes the LLM-controlled filepath parameter directly to open for reading and writing without traversal rejection, symlink resolution, a w…

vulnerable: 4.5.115 ... 4.6.9 (78 versions)

PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default ## Summary The published A2U advisory `GHSA-f292-66h9-fpmf` says unauthenticated A2U event streaming was fixed in `praisonai` `4.5.115`. …

vulnerable: 0.0.1 ... 4.6.9 (763 versions)

PraisonAI before 4.6.78 contains an unenforced security policy vulnerability in the default Subprocess Sandbox backend where blocked_commands, blocked_paths, blocked_imports, allow_subprocess, and allow_file_write restrictions are complete…

vulnerable: 0.0.1 ... 4.6.9 (763 versions)

PraisonAI before 4.6.78 fails to validate the caller-controlled dimension argument in the PGVector and Cassandra knowledge-store create_collection() backends. Although schema, keyspace, and collection-name identifiers are validated, the di…

vulnerable: 0.0.1 ... 4.6.9 (763 versions)

PraisonAI before 4.6.78 exposes the MCP HTTP-stream transport without authentication by default: the CLI --api-key option defaults to None, and the server only enforces Authorization/Bearer checks when an API key is configured. When an ope…

vulnerable: 0.0.1 ... 4.6.9 (763 versions)

PraisonAI AgentMail versions before 4.6.78 lack signature verification in webhook mode, allowing unauthenticated attackers to inject messages with spoofed sender addresses. Attackers can POST crafted message.received events to the webhook …

vulnerable: 0.0.1 ... 4.6.9 (763 versions)

PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Python source code for API servers. Attackers can inject arbitrary Python expressions through the deploy.api.host and agents_file configuration …

vulnerable: 0.0.1 ... 4.6.9 (763 versions)

PraisonAI before 4.6.78 contains an authentication bypass in the Call API agent invocation endpoints (src/praisonai/praisonai/api/agent_invoke.py) when PRAISONAI_CALL_AUTH=disabled is configured. The safeguard intended to restrict the disa…

vulnerable: 0.0.1 ... 4.6.9 (763 versions)

PraisonAI versions before 4.6.78 contain a code injection vulnerability in deploy/api.py where the agents_file parameter is directly interpolated into an f-string without sanitization. Attackers can inject arbitrary Python code that execut…

vulnerable: 0.0.1 ... 4.6.9 (763 versions)

PraisonAI is a multi-agent teams system. Prior to version 4.6.78, the `deploy/api.py` module generates Python server code by directly interpolating the `agents_file` parameter into an f-string that is then written to a file and executed vi…

vulnerable: 0.0.1 ... 4.6.9 (731 versions)

Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absolute filesystem paths by supplying a crafted tar archive with a SYMTYPE entry …