PraisonAI CVE-2026-56076

Requires the victim to (a) be running a PraisonAI AGUI server reachable from the victim's browser (the documented localhost usage pattern is sufficient) and (b) visit an attacker-controlled web page in that same browser session - this is the UI:P (passive user interaction) factor in the CVSS 4.0 vector. No authentication, no special privileges, no preflight-defeating tricks beyond setting Content-Type to a CORS-safe value (e.g., text/plain) are needed because the endpoint hardcodes Access-Control-Allow-Origin: * and Starlette parses the JSON body regardless of Content-Type. Limiting factors: the AGUI server must actually be running at the time of the visit and the attacker must know or guess the bound host/port (commonly http://localhost:8000); browsers that block private-network requests by default (Chrome's Private Network Access for non-secure contexts) may partially mitigate against public-internet origins reaching localhost.

Vendor CVSS 4.0 of 8.6 (AV:N/AC:L/PR:N/UI:P/VC:H/VI:H/VA:N) accurately reflects the realistic risk: exploitation needs no authentication and no special network position, only that the victim browse an attacker page while the local AGUI server is running - the documented deployment pattern. EPSS and KEV data were not supplied, so probabilistic exploitation likelihood is unquantified; this is not on CISA KEV. The detailed attack flow in the GHSA advisory functions as a working blueprint even though no PoC repository is referenced, raising real-world risk above what a 'just CORS misconfig' label might imply because the impact includes tool execution and data exfiltration, not merely credential leakage. Note one data conflict: the NVD description says 'before 1.5.128' while the pip advisory pins the fix at 4.5.128 - defenders should verify the version scheme with the vendor before assuming a low-numbered install is safe.

A developer runs PraisonAI's AGUI server locally on port 8000 to use the agent UI, then visits an attacker-controlled or compromised website in the same browser. Attacker JavaScript issues fetch('http://localhost:8000/agui', {method:'POST', headers:{'Content-Type':'text/plain'}, body: JSON.stringify(runInput)}) - the text/plain Content-Type makes it a CORS simple request, the wildcard ACAO lets the script read the streamed SSE response, and the agent executes with its full tool set, returning command output, file contents, and environment data to the attacker page.