EUVD-2026-21154
GHSA-cfg2-mxfj-j6pw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionGitHub Advisory
PraisonAI is a multi-agent teams system. Prior to 4.5.128, the Flask API endpoint in src/praisonai/api.py renders agent output as HTML without effective sanitization. The _sanitize_html function relies on the nh3 library, which is not listed as a required or optional dependency in pyproject.toml. When nh3 is absent (the default installation), the sanitizer is a no-op that returns HTML unchanged. An attacker who can influence agent input (via RAG data poisoning, web scraping results, or prompt injection) can inject arbitrary JavaScript that executes in the browser of anyone viewing the API output. This vulnerability is fixed in 4.5.128.
AnalysisAI
Stored cross-site scripting (XSS) in PraisonAI versions prior to 4.5.128 allows remote attackers to inject arbitrary JavaScript into agent output rendered by the Flask API endpoint. The vulnerability exists because the _sanitize_html function depends on the nh3 library, which is not declared as a required dependency in pyproject.toml; when nh3 is absent (default installation), HTML sanitization becomes a no-op. Attackers can exploit this via RAG data poisoning, malicious web scraping results, or prompt injection to execute malicious scripts in the browsers of users viewing API output. No public exploit code or active exploitation has been confirmed.
Technical ContextAI
PraisonAI is a Python-based multi-agent orchestration framework that uses Flask to expose API endpoints for agent interaction and output display. The vulnerability resides in src/praisonai/api.py, where agent-generated responses are rendered as HTML content without proper input validation. The code attempts to sanitize HTML using the nh3 library (a Rust-backed HTML sanitizer), but because nh3 is an optional or missing dependency rather than a required one in the project's pyproject.toml configuration, the sanitization function degrades to a pass-through that does not remove or escape potentially malicious JavaScript. This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability where untrusted data from multiple sources (RAG retrieval, web scraping, user prompts) flows directly into HTML rendering without safe encoding or validation.
RemediationAI
Upgrade PraisonAI to version 4.5.128 or later, which fixes the sanitization bypass. As an immediate workaround prior to patching, ensure the nh3 library is explicitly installed as a dependency (pip install nh3) to restore the HTML sanitizer functionality; however, this is a partial mitigation and does not address the root cause of missing dependency declaration. Additionally, implement Content Security Policy (CSP) headers on API endpoints to restrict script execution, sanitize RAG data sources and web scraping results at ingestion time, and apply strict input validation to agent prompts. Refer to the GitHub Security Advisory at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-cfg2-mxfj-j6pw for comprehensive remediation guidance.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today