PraisonAI EUVD-2026-65544

Exploitation requires: (1) the victim must be running praisonai mcp serve --transport http-stream - other transports such as stdio are not affected; (2) the MCP server must be in its default no-API-key configuration, which is the out-of-box state; (3) the victim must visit a webpage served from a domain whose DNS hostname begins with localhost or 127.0.0.1 (e.g., localhost.attacker.com), which causes modern browsers to send a matching Origin header; and (4) the attacker must control such a domain. Exploitation is bounded by the following limiting factors: user interaction is mandatory (victim must navigate to the attacker's page); the tools/call endpoint must be reachable from the victim's browser (default localhost binding satisfies this); and if the operator has configured an API key (auth_token), exploitation is blocked because CORS simple requests cannot include custom Authorization headers. Non-default transport configurations (stdio, WebSocket with independent auth) are not susceptible to this origin-bypass attack vector.

The CVSS 7.6 score is well-calibrated: AV:N reflects the browser-mediated delivery path, AC:L is justified because the only attacker requirement is registering a domain whose label begins with 'localhost' (trivial), PR:N is accurate since no credentials are needed on the target MCP server, and UI:R correctly captures the victim-visits-page requirement. The I:H integrity rating is appropriate given that file writes can persist attacker-controlled agent instructions indefinitely. The S:U (unchanged scope) designation may modestly understate impact - persistent prompt injection into agent instruction files means future agent runs on the victim's machine will operate under attacker control, which has cascading confidentiality and integrity implications beyond the MCP process itself. EPSS data is absent from the provided intelligence, so exploitation probability cannot be quantified from base rates alone. There is no CISA KEV listing and no confirmed public exploit code, though the GHSA advisory discloses the exact bypass technique and sufficient implementation detail that an independent researcher could reproduce the attack within hours. The vulnerability is strictly developer-facing: production deployments that do not run the HTTP-stream transport (e.g., stdio-only configurations) are not exposed. Given the low attacker effort after victim interaction and the potential for durable agent compromise, any development team running PraisonAI's HTTP-stream MCP server should prioritize this patch regardless of organization size.

An attacker registers the DNS name localhost.attacker.com and hosts a webpage containing JavaScript that issues a fetch POST to http://localhost:<port>/mcp with Content-Type: text/plain (a CORS simple request). When a developer running PraisonAI's MCP HTTP-stream server visits this page, their browser sends Origin: http://localhost.attacker.com, which the server's _validate_origin accepts because it starts with http://localhost. The forged request invokes a file-write MCP tool to create an agent instruction file with attacker-controlled content under the agent's rules directory, causing the victim's agent runtime to silently execute attacker instructions on every subsequent agent invocation. No public exploit code has been identified at time of analysis, but the GHSA advisory provides sufficient technical detail for straightforward reproduction.