EUVD-2026-22211
GHSA-8x8f-54wf-vv92
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
6DescriptionGitHub Advisory
PraisonAI is a multi-agent teams system. In versions below 4.5.139 of PraisonAI and 1.5.140 of praisonaiagents, the browser bridge (praisonai browser start) is vulnerable to unauthenticated remote session hijacking due to missing authentication and a bypassable origin check on its /ws WebSocket endpoint. The server binds to 0.0.0.0 by default and only validates the Origin header when one is present, meaning any non-browser client that omits the header is accepted without restriction. An unauthenticated network attacker can connect, send a start_session message, and the server will route it to the first idle browser-extension WebSocket (effectively hijacking that session) and then broadcast all resulting automation actions and outputs back to the attacker. This enables unauthorized remote control of connected browser automation sessions, leakage of sensitive page context and automation results, and misuse of model-backed browser actions in any environment where the bridge is network-reachable. This issue has been fixed in versions 4.5.139 of PraisonAI and 1.5.140 of praisonaiagents.
AnalysisAI
Unauthenticated remote session hijacking in PraisonAI's browser bridge (versions <4.5.139) and praisonaiagents (<1.5.140) allows network attackers to control browser automation sessions without authentication. The /ws WebSocket endpoint accepts connections from any client omitting the Origin header, enabling attackers to send start_session commands that hijack idle browser-extension sessions and receive all automation outputs. With CVSS 9.1 (Critical) scoring driven by network attack vector, low complexity, and no authentication requirement (AV:N/AC:L/PR:N), this represents a severe risk in any deployment where the default 0.0.0.0 binding exposes the service to untrusted networks. No public exploit identified at time of analysis, though exploitation requires only basic WebSocket client capabilities.
Technical ContextAI
PraisonAI is a multi-agent automation framework that includes a browser bridge component facilitating communication between a server and browser-extension clients via WebSockets. The vulnerability stems from CWE-306 (Missing Authentication for Critical Function) in the WebSocket endpoint implementation. The server's Origin header validation is conditional-it only checks the header when present, allowing non-browser clients (curl, Python websocket libraries, custom scripts) to bypass the control entirely by omitting the header. The affected CPE strings identify two distinct packages: mervinpraison:praisonai (main framework) and mervinpraison:praisonaiagents (agents library), both requiring patches. The 0.0.0.0 default binding exposes the service to all network interfaces rather than localhost-only, amplifying the attack surface. The session-routing logic lacks any cryptographic authentication or session tokens, instead relying solely on the flawed Origin check to determine legitimate clients.
RemediationAI
Immediately upgrade to patched versions: PraisonAI 4.5.139 or later, and praisonaiagents 1.5.140 or later. Users can update via Python package managers with 'pip install --upgrade praisonai praisonaiagents'. If immediate patching is not feasible, implement network-level controls to restrict WebSocket endpoint access: bind the browser bridge to localhost (127.0.0.1) instead of 0.0.0.0, deploy firewall rules blocking external access to the WebSocket port, or place the service behind authenticated reverse proxy with mandatory authentication. Do not rely on Origin header validation as a security control in the vulnerable versions. For production deployments, review network architecture to ensure the browser bridge is not exposed to untrusted networks, and audit logs for unexpected WebSocket connections or start_session messages from unauthorized sources. Complete remediation guidance and affected version ranges are detailed in the GitHub security advisory at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8x8f-54wf-vv92.
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Server-Side Request Forgery in PraisonAI before version 4.6.58 allows unauthenticated remote attackers to force the appl
Memory exhaustion in PraisonAI's MCP HTTP Stream server allows remote unauthenticated attackers to crash the service by
Remote code execution in PraisonAI before 1.6.78 allows attackers to run arbitrary Python on the host by manipulating th
Unauthorized filesystem mutation in praisonaiagents allows an LLM-controlled agent to rewrite arbitrary on-disk source f
Unauthenticated remote command execution in PraisonAI's bundled Claude GitHub Actions workflow (versions before 4.6.40)
Root-level command execution and arbitrary file write in PraisonAI's AICoder component (all versions before 4.6.78) let
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today