PraisonAI AgentOS CVE-2026-57140

Requires the npm praisonai package's AgentOS HTTP server to be running (e.g., via app.serve()) and reachable over the network. No authentication, user interaction, or special privileges are needed against the default configuration: host defaults to 0.0.0.0 (listens on all interfaces) and corsOrigins defaults to ['*'], and the GET /api/agents and POST /api/chat routes have no auth/authz middleware. Limiting factors: exploitation depends on the operator actually deploying AgentOS and not overriding host to a loopback/bind address or placing it behind a reverse proxy/firewall; the depth of impact (credentials, tools, memory) depends on what tools and secrets the operator wired into the invoked agents. Affects npm versions 1.6.0 through 1.7.1; the TypeScript-specific issue is separate from the Python/PyPI AgentOS advisories.

This is a genuinely high-priority network-exposed exposure, though the CVSS 9.4 slightly overstates the confirmed impact. The signals are internally consistent on the exposure side: CVSS AV:N/AC:L/PR:N/UI:N matches the description precisely - AgentOS binds to 0.0.0.0 by default (src/os/config.ts) and registers GET /api/agents and POST /api/chat with no authentication middleware (CWE-306), so any caller with network reachability can list agents and invoke them without credentials. SSVC reinforces the concern (Automatable: yes, Technical Impact: total), which fits a simple unauthenticated HTTP request. Against this, the exploitation-likelihood signals are modest: SSVC Exploitation is 'none', EPSS is only 0.56% (45th percentile), there is no CISA KEV listing, and no public exploit code is referenced - so the correct posture is 'no public exploit identified at time of analysis' rather than active exploitation. The C:H/I:H/A:L impact rating leans on the description's speculative language ('potentially reaching its tools, memory, external APIs, credentials, and workflow state'); what is CONFIRMED is disclosure of agent names, roles, and the first 100 characters of instructions plus arbitrary agent invocation, while credential/RCE reach is contingent on how each deployment wires up tools. Availability impact (A:L) is weakly justified. Net: real priority for anyone running the npm AgentOS server on an untrusted network, but the true blast radius is deployment-dependent, and low EPSS/no-KEV means this is opportunistic-if-exposed rather than mass-exploited today.

A developer runs the npm praisonai AgentOS server with app.serve({ port: 8000 }), which listens on 0.0.0.0 across all interfaces. An unauthenticated attacker on the same network (or the internet, if the port is exposed) sends GET /api/agents to enumerate agent names, roles, and instruction prefixes, then POST /api/chat to invoke a chosen agent, driving its tools, memory, and any wired-in credentials or external APIs. No public exploit code is referenced, but exploitation is a trivial pair of HTTP requests requiring no authentication.