EUVD-2026-42894
GHSA-5c3v-h6hw-4gx7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with no authentication required; integrity impact limited to model instruction manipulation with no confidentiality or availability impact to the vulnerable system.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
PraisonAI before 4.6.78 contains a prompt injection defense bypass vulnerability where the injection defense only blocks threats classified as CRITICAL, requiring three or more detector families to match simultaneously. Attackers can craft single or double-vector prompt injections that are classified as HIGH threat level and pass through unblocked to reach the model.
AnalysisAI
Prompt injection defenses in PraisonAI before version 4.6.78 can be bypassed by crafting single or double-vector injections classified at the HIGH threat level, which the protection mechanism silently allows through to the underlying language model. The defense only blocks CRITICAL-classified injections - those matching three or more detector families simultaneously - meaning attackers who deliberately keep their payload below that threshold face no blocking at all. No active exploitation has been confirmed via CISA KEV and no public exploit code has been identified at time of analysis, though the bypass technique is conceptually straightforward given that the classification threshold logic is now publicly disclosed.
Technical ContextAI
PraisonAI (CPE: cpe:2.3:a:mervinpraison:praisonai:*:*:*:*:*:*:*:*) is an open-source multi-agent AI orchestration framework built by MervinPraison. Its built-in prompt injection defense employs a multi-family detector architecture in which threat severity is determined by how many independent detector families simultaneously flag a given input. The flaw maps to CWE-693 (Protection Mechanism Failure): the enforcement logic contains a hard-coded severity gate that only blocks inputs reaching CRITICAL classification (three or more detector families triggering). Payloads that activate only one or two detector families are rated HIGH by the classifier but are never acted upon - the gate passes them directly to the model. This represents a design flaw in the thresholding policy rather than a bypass of any individual detector.
RemediationAI
Upgrade PraisonAI to version 4.6.78 or later, as confirmed by the vendor security advisory at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4r3p-w3mc-5v34. Vendor-released patch: 4.6.78. If immediate upgrade is not feasible, consider patching the detection threshold configuration to block HIGH-classified injections in addition to CRITICAL ones - note this may increase false-positive rates on benign inputs and should be validated in a staging environment first. As a compensating control, restrict the capabilities available to PraisonAI agents to the minimum necessary (principle of least privilege for tool access), so that even a successful injection cannot reach sensitive systems or data. Additionally, apply output-layer filtering or human-in-the-loop review for high-stakes agent actions to limit the downstream impact of any injection that reaches the model.
WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an att
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Server-side request forgery in PraisonAI's web_crawl() function (versions 1.5.128-1.6.57) allows an attacker who can inf
Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to ex
Remote unauthenticated access to PraisonAI's legacy Flask API server allows attackers to execute configured agent workfl
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Server-Side Request Forgery in PraisonAI before version 4.6.58 allows unauthenticated remote attackers to force the appl
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today