EUVD-2026-21212
GHSA-pv9q-275h-rh7x
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionGitHub Advisory
PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI treats remotely fetched template files as trusted executable code without integrity verification, origin validation, or user confirmation, enabling supply chain attacks through malicious templates. This vulnerability is fixed in 4.5.128.
AnalysisAI
Remote code execution in PraisonAI multi-agent framework (versions prior to 4.5.128) allows unauthenticated attackers to execute arbitrary code via malicious template files fetched from remote sources. The framework downloads and executes template files without integrity verification, origin validation, or user confirmation, creating a supply chain attack vector. Attackers with network access can distribute weaponized templates that execute when retrieved by victims, achieving high confidentiality and integrity compromise with scope change. No public exploit identified at time of analysis.
Technical ContextAI
CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) flaw in PraisonAI's template handling mechanism. System directly executes remotely sourced template content without cryptographic signature verification or origin allowlist enforcement. CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:C indicates network-exploitable with user interaction requirement, enabling cross-scope compromise when victim retrieves attacker-controlled template.
RemediationAI
Vendor-released patch: upgrade to PraisonAI version 4.5.128 or later, which implements integrity verification for remote templates. Organizations should immediately update to the fixed version via standard package manager (pip install --upgrade praisonai). Until patching is complete, disable remote template fetching functionality if operationally feasible, restrict template sources to trusted internal repositories only, and implement network-level controls to prevent outbound template retrieval. Review recent template usage logs for indicators of compromise. Full vulnerability disclosure and remediation guidance available at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-pv9q-275h-rh7x
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Server-Side Request Forgery in PraisonAI before version 4.6.58 allows unauthenticated remote attackers to force the appl
Memory exhaustion in PraisonAI's MCP HTTP Stream server allows remote unauthenticated attackers to crash the service by
Remote code execution in PraisonAI before 1.6.78 allows attackers to run arbitrary Python on the host by manipulating th
Unauthorized filesystem mutation in praisonaiagents allows an LLM-controlled agent to rewrite arbitrary on-disk source f
Unauthenticated remote command execution in PraisonAI's bundled Claude GitHub Actions workflow (versions before 4.6.40)
Root-level command execution and arbitrary file write in PraisonAI's AICoder component (all versions before 4.6.78) let
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today