EUVD-2026-43179
GHSA-5r2q-3wg3-57m2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, unauthenticated, low-complexity submission of a prompt yields system-prompt disclosure (C:H); unauthorized tool invocation implies limited integrity impact (I:L), with no availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
PraisonAI versions before 4.6.78 contain a prompt injection defense misconfiguration where the block threshold defaults to CRITICAL severity, allowing HIGH-level threats to pass through unblocked. Attackers can submit single-vector prompt injection attacks such as instruction overrides or financial manipulation that trigger HIGH severity detection but are logged without blocking, enabling system prompt extraction and unauthorized tool invocations.
AnalysisAI
System prompt extraction and unauthorized tool invocation in PraisonAI before 4.6.78 arise because the prompt-injection defense ships with its blocking threshold defaulting to CRITICAL, so HIGH-severity injection attempts are detected and logged but never blocked. Any remote user interacting with a PraisonAI agent can submit single-vector prompt injection (instruction overrides, financial manipulation) that scores HIGH and passes through, leaking the system prompt and triggering agent tools without authorization. No public exploit identified at time of analysis, and the issue is not in CISA KEV; the vendor CVSS 4.0 score is 8.7 (High).
Technical ContextAI
PraisonAI is a multi-agent LLM orchestration framework (Python/CPE cpe:2.3:a:mervinpraison:praisonai) that includes a built-in prompt-injection guardrail which classifies incoming content by severity and blocks at or above a configured threshold. The root cause is CWE-1188 (insecure default resource initialization): the guardrail's block threshold is initialized to CRITICAL rather than a safer HIGH baseline, creating a detection-without-enforcement gap where HIGH-severity classifications generate log entries but no block action. Because LLM agents route user-controlled text directly into the model context and can call attached tools, an unblocked HIGH-severity injection can override system instructions and reach the tool-invocation layer.
RemediationAI
Vendor-released patch: 4.6.78 - upgrade PraisonAI to 4.6.78 or later, which corrects the default block threshold. Consult the vendor advisory GHSA-fj8f-m44g-c479 (https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-fj8f-m44g-c479) for details. As a compensating control until patched, explicitly configure the guardrail's block threshold down to HIGH (or lower) rather than leaving it at the CRITICAL default, which closes the specific bypass at the cost of potentially more false-positive blocks on legitimate content; additionally, restrict which tools agents may invoke and remove or scope down sensitive tool bindings, and avoid placing secrets in the system prompt so that a prompt-extraction event has limited value. Where feasible, gate agent endpoints behind authentication and rate limiting to reduce anonymous probing.
WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an att
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Server-side request forgery in PraisonAI's web_crawl() function (versions 1.5.128-1.6.57) allows an attacker who can inf
Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to ex
Remote unauthenticated access to PraisonAI's legacy Flask API server allows attackers to execute configured agent workfl
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Server-Side Request Forgery in PraisonAI before version 4.6.58 allows unauthenticated remote attackers to force the appl
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today