EUVD-2026-78423
GHSA-p69m-4f92-2v84
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable agent input with a trivially bypassable blocklist (AC:L, PR:N) yields full host RCE (C:H/I:H/A:H); deployment gate (codeMode enabled) is config, not a CVSS metric.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
PraisonAI is a multi-agent teams system. Prior to 1.7.2, the codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts executes model-generated JavaScript with new Function() and with(sandbox), while a regular-expression blocklist can be bypassed with Function('return this')() to recover the global object and by constructing the child_process module name dynamically. An attacker who can influence the code argument can access host process capabilities, read or write files, obtain environment credentials, and execute operating-system commands with the PraisonAI process privileges. This issue is fixed in version 1.7.2.
AnalysisAI
Remote code execution in the PraisonAI TypeScript codeMode tool (npm package praisonai <= 1.7.1) lets an attacker who can influence the model-generated code argument escape the regex blocklist 'sandbox' and run arbitrary JavaScript with the host process's privileges, reading and writing files, harvesting environment credentials, and executing operating-system commands. The CVSS 3.1 vector is unauthenticated and network-facing (AV:N/AC:L/PR:N/UI:N, 9.8) with total confidentiality and integrity impact, though the real-world prerequisite is that codeMode is enabled for an agent and the attacker can steer the tool argument - typically through prompt injection into untrusted content the agent ingests. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires that the codeMode tool (src/praisonai-ts/src/tools/builtins/code-mode.ts) is enabled for agents AND that the attacker can influence the model-generated `code` argument passed to the tool's execute method - in practice via prompt injection into untrusted content the agent processes. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue, not a high-CVSS-but-low-risk paper cut. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the TypeScript SDK to praisonai 1.7.2 or later - the vendor-released fix version - which is delivered via the upstream commit 709a0387853709a5e2f2c34680fa64cada252c27 and the release tag v4.6.60; if you consume the Python packaging, pin `praisonai>=4.6.60` as the Dockerfiles and `pyproject.toml` now do. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every deployment of the npm praisonai package at version 1.7.1 or earlier, confirm which agents have the codeMode tool enabled, and immediately disable codeMode for any agent that ingests untrusted or externally sourced content; treat the exposed hosts as potentially compromised and review their outbound network activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
PraisonAI's TypeScript MCP server (npm package `praisonai`, versions 1.5.0 through 1.7.1) exposes an HTTP JSON-RPC trans
WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an att
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Server-side request forgery in PraisonAI's web_crawl() function (versions 1.5.128-1.6.57) allows an attacker who can inf
Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to ex
Remote unauthenticated access to PraisonAI's legacy Flask API server allows attackers to execute configured agent workfl
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today