PraisonAI CVE-2026-56835

Exploitation requires three concrete conditions: (1) the PraisonAI deployment subscribes to Slack's app_mention event (a distinct event type from message.*), (2) the attacker is a Slack workspace user who can mention the bot in a channel where the Slack app is installed, and (3) the bot is configured with restrictive controls - allowed_users, allowed_channels, or unknown_user_policy="deny" - that the attacker would otherwise fail; without such controls there is nothing to bypass. The bug is in src/praisonai/praisonai/bots/slack.py: the app_mention handler never calls is_channel_allowed(), is_user_allowed(), or UnknownUserHandler.handle(), whereas the message handler does. Limiting factors that reduce realistic risk: the attacker must already hold Slack workspace membership and the ability to mention the bot, the app must be present in the target channel, app_mention must be subscribed, and the ultimate confidentiality/integrity impact is bounded by which agent and tools the operator has deployed and auto-approved.

CVSS base score is 8.3 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L, reflecting a network-reachable, low-complexity authorization bypass (CWE-862/CWE-863) requiring only low privilege. The PR:L maps to a real prerequisite: the attacker must be a Slack workspace user able to mention the bot, so this is authenticated at the Slack-workspace level, not anonymous internet exploitation. No EPSS score and no CISA KEV entry are present in the input, so there is no quantitative exploitation-probability signal and no evidence of active exploitation; the only forward-looking signal is the vuln.today Decision label 'this_week', which indicates a prompt-but-not-emergency priority consistent with a patched flaw that is not yet known-exploited. A local-only proof-of-vulnerability is published in the GHSA advisory (it mocks Slack in-process and does not connect to Slack or require tokens), demonstrating the bypass against v4.6.58, so a public PoC reference exists but it is not a weaponized remote exploit. The C:H/I:H rating is conditional: the advisory states the downstream impact depends on the deployed agent and its tools, and is high only because PraisonAI's default bot config auto-approves 'safe' tools (web, memory, scheduling, file, planning, skill). Net assessment: a genuine, patchable priority for anyone running the PraisonAI Slack bot with app_mention subscribed and allowlist/pairing controls configured, but lower real-world urgency than the raw 8.3 suggests because there is no KEV/EPSS evidence of widespread exploitation and the worst-case impact is deployment-dependent.

A Slack workspace member who is not in BotConfig.allowed_users mentions the PraisonAI bot in a channel where the app is present but which is not in allowed_channels. The app_mention event handler strips the mention and directly invokes the agent session without running the channel check, user allowlist check, or UnknownUserHandler policy that the normal message handler enforces, so the attacker's arbitrary prompt reaches the configured agent and its auto-approved tools. A local-only PoV in the GHSA advisory reproduces this against v4.6.58, showing the same payload dropped by the message handler but accepted via app_mention.