EUVD-2026-65545
GHSA-6g6r-q6gw-w8fg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Forgeable Origin is the sole gate (PR:N, AC:L, UI:N); AV:N reflects the network-service intent though default loopback bind limits real reach; cookie theft and browser control give C:H/I:H, no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server _handle_connection() checks Chrome extension origins with re.match() and the unanchored expression chrome-extension://[a-z0-9]{32}. Extra trailing characters pass before websocket.accept(), allowing start_session commands and unauthorized browser automation. This issue is fixed in version 4.6.58.
AnalysisAI
WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an attacker forge a Chrome-extension Origin header and drive connected browser extensions. The check uses re.match() against the unanchored pattern chrome-extension://[a-z0-9]{32}, so any Origin with 32+ trailing characters is accepted before websocket.accept(), after which start_session commands trigger arbitrary browser automation, cookie theft, and screenshot capture. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the PraisonAI Browser Server to be running and reachable by the attacker (default listener 127.0.0.1:8765), plus at least one Chrome extension actively connected to that server for the start_session/start_automation payload to have an effect. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Multiple signals point to genuine severity: the supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H) yields 9.1, the flaw is trivially exploitable (a one-line Origin forgery), and a PoC is public. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade PraisonAI to 4.6.58 or later (pip install --upgrade 'praisonai>=4.6.58'), which is the definitive fix per GHSA-6g6r-q6gw-w8fg and release v4.6.58. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all instances of PraisonAI Browser Server and the versions deployed, confirm which instances are exposed to external WebSocket connections, and document connected browser extensions and affected user populations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Server-Side Request Forgery in PraisonAI before version 4.6.58 allows unauthenticated remote attackers to force the appl
Memory exhaustion in PraisonAI's MCP HTTP Stream server allows remote unauthenticated attackers to crash the service by
Remote code execution in PraisonAI before 1.6.78 allows attackers to run arbitrary Python on the host by manipulating th
Unauthorized filesystem mutation in praisonaiagents allows an LLM-controlled agent to rewrite arbitrary on-disk source f
Unauthenticated remote command execution in PraisonAI's bundled Claude GitHub Actions workflow (versions before 4.6.40)
Root-level command execution and arbitrary file write in PraisonAI's AICoder component (all versions before 4.6.78) let
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today