Praisonai CVE-2026-40289

PraisonAI versions below 4.5.139 and praisonaiagents below 1.5.140 with browser bridge enabled (praisonai browser start). Server must bind to 0.0.0.0 (default). Unauthenticated remote attacker omits Origin header in WebSocket connection to /ws endpoint. No victim interaction required.

This vulnerability presents critical real-world risk despite lacking confirmed active exploitation signals. The CVSS 9.1 score accurately reflects severe technical impact: network-accessible (AV:N), trivial exploitation complexity (AC:L), zero authentication barriers (PR:N), high confidentiality and integrity impact (C:H/I:H) from session hijacking and data exfiltration. EPSS data not provided, but the low technical barrier suggests high automatable exploitation potential per SSVC framework-any attacker with network access and basic WebSocket knowledge can exploit this. The absence of public exploit code (POC=not indicated, KEV=not listed) provides temporary risk reduction, but the detailed GitHub security advisory effectively serves as exploitation documentation. Most concerning: the default 0.0.0.0 binding means cloud deployments, containerized instances, or development environments on shared networks are immediately vulnerable. Organizations using PraisonAI for browser automation involving sensitive workflows (credential entry, data scraping, authenticated sessions) face immediate compromise risk. This is a legitimate critical-priority issue, not a theoretical high-CVSS scenario-the attack requires minimal sophistication and enables direct session control.

A remote attacker on the same network or internet-facing deployment identifies the PraisonAI browser bridge listening on default port (network scan or service fingerprinting). Using a simple Python WebSocket client or curl, the attacker establishes a connection to the /ws endpoint without including an Origin header, bypassing the conditional validation. The attacker sends a start_session message with arbitrary parameters, which the server routes to the first idle browser-extension WebSocket, effectively hijacking that legitimate user's automation session. All subsequent browser actions-page navigation, form inputs, scraped data, authentication credentials entered via automation-stream back to the attacker's WebSocket connection, enabling real-time monitoring and control of the victim's browser session without any authentication challenge.