EUVD-2026-65544
GHSA-pvph-5j39-v8qc
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L
Network delivery via browser (AV:N), trivial domain registration (AC:L), no server credentials required (PR:N), victim page visit required (UI:R); persistent file writes yield high integrity impact with low confidentiality and availability side effects.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L
Lifecycle Timeline
4DescriptionCVE.org
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream _validate_origin uses request_origin.startswith(allowed), allowing the attacker-controlled localhost.attacker.com HTTP origin to satisfy the localhost allowlist. A webpage can send Content-Type: text/plain requests without preflight and invoke tools/call without an API key, including file writes that persist agent instructions. This issue is fixed in version 4.6.58.
AnalysisAI
Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to execute arbitrary MCP tools on a developer's local machine when a victim visits a malicious webpage. The attack is enabled by a flawed prefix-match origin check (startswith) in versions prior to 4.6.58 that accepts http://localhost.attacker.com as a valid localhost origin, and is further facilitated by the absence of a default API key and the CORS simple-request mechanism (Content-Type: text/plain) that bypasses browser preflight. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the victim must be running `praisonai mcp serve --transport http-stream` - other transports such as stdio are not affected; (2) the MCP server must be in its default no-API-key configuration, which is the out-of-box state; (3) the victim must visit a webpage served from a domain whose DNS hostname begins with `localhost` or `127.0.0.1` (e.g., `localhost.attacker.com`), which causes modern browsers to send a matching Origin header; and (4) the attacker must control such a domain. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.6 score is well-calibrated: AV:N reflects the browser-mediated delivery path, AC:L is justified because the only attacker requirement is registering a domain whose label begins with 'localhost' (trivial), PR:N is accurate since no credentials are needed on the target MCP server, and UI:R correctly captures the victim-visits-page requirement. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade PraisonAI to version 4.6.58 or later, confirmed fixed in the tagged release at https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58 and patch commit https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running PraisonAI versions below 4.6.58 and assess developer exposure across the organization. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Server-Side Request Forgery in PraisonAI before version 4.6.58 allows unauthenticated remote attackers to force the appl
Memory exhaustion in PraisonAI's MCP HTTP Stream server allows remote unauthenticated attackers to crash the service by
Remote code execution in PraisonAI before 1.6.78 allows attackers to run arbitrary Python on the host by manipulating th
Unauthorized filesystem mutation in praisonaiagents allows an LLM-controlled agent to rewrite arbitrary on-disk source f
Unauthenticated remote command execution in PraisonAI's bundled Claude GitHub Actions workflow (versions before 4.6.40)
Root-level command execution and arbitrary file write in PraisonAI's AICoder component (all versions before 4.6.78) let
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today