PraisonAI CVE-2026-55536

Requires the PraisonAI Browser Server to be running and reachable by the attacker (default listener 127.0.0.1:8765), plus at least one Chrome extension actively connected to that server for the start_session/start_automation payload to have an effect. No authentication is needed once reachable - the only gate is the forgeable Origin header, which any non-browser WebSocket client can set to 'chrome-extension://' + 32 alphanumerics + arbitrary trailing characters. Limiting factors: the default loopback bind means remote exploitation requires the operator to have exposed the port (or the attacker to have local/adjacent access or a browser-based cross-origin path), and impact is contingent on a live connected extension; genuine browsers cannot forge the Origin header, so exploitation needs a scripted client.

Multiple signals point to genuine severity: the supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H) yields 9.1, the flaw is trivially exploitable (a one-line Origin forgery), and a PoC is public. However, these must be weighed against a key limiting factor the vector does not capture: the server binds to 127.0.0.1:8765 by default, so 'network' reachability presupposes the operator exposed the port or an attacker already has local/co-resident code execution or can leverage a browser-driven cross-origin vector - this tempers the raw AV:N. There is no EPSS score, no KEV listing, and no SSVC data in the input, so exploitation-probability and automatability cannot be quantified from the provided sources. The absence of KEV suggests no confirmed in-the-wild use, but the low exploitation complexity and high impact (session-cookie theft, arbitrary browser actions) mean any operator running the browser server on an accessible interface should treat this as an urgent patch. On balance this is a real priority for exposed deployments rather than a high-CVSS-but-low-real-risk finding, with the localhost default being the primary risk reducer for typical installs.

An attacker who can reach the browser server's WebSocket port opens a raw (non-browser) WebSocket client and sets the Origin header to 'chrome-extension://' followed by 32 alphanumeric characters plus any trailing bytes, satisfying the unanchored re.match() and passing websocket.accept(). They then send a start_session command with an attacker-chosen goal, which broadcasts start_automation to every connected Chrome extension so the victim's browser silently performs the goal - exfiltrating cookies or capturing screenshots. A published PoC in the advisory demonstrates the regex bypass and low attack complexity.