Praisonai

WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an attacker forge a Chrome-extension Origin header and drive connected browser extensions. The check uses re.match() against the unanchored pattern chrome-extension://[a-z0-9]{32}, so any Origin with 32+ trailing characters is accepted before websocket.accept(), after which start_session commands trigger arbitrary browser automation, cookie theft, and screenshot capture. This is a patch bypass of CVE-2026-40289 (GHSA-8x8f-54wf-vv92); a working PoC is published in the advisory, though it is not in CISA KEV - no public exploit weaponization beyond the advisory PoC is identified.

Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to execute arbitrary MCP tools on a developer's local machine when a victim visits a malicious webpage. The attack is enabled by a flawed prefix-match origin check (`startswith`) in versions prior to 4.6.58 that accepts `http://localhost.attacker.com` as a valid localhost origin, and is further facilitated by the absence of a default API key and the CORS simple-request mechanism (Content-Type: text/plain) that bypasses browser preflight. The highest-impact consequence is persistent prompt injection: a forged request can write attacker-controlled agent instruction files that the runtime loads on every subsequent agent run. No public exploit is identified at time of analysis; vendor-released patch 4.6.58 is confirmed.

Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe execution endpoints despite authentication being nominally enabled. Versions prior to 4.6.58 of the pip package are affected: when the server is started with --auth api-key or --auth jwt but the corresponding PRAISONAI_API_KEY or PRAISONAI_JWT_SECRET environment variable is absent, create_auth_middleware() silently bypasses all authentication checks. The CLI safety check that blocks external binding only verifies auth mode is not 'none', failing to detect this secret-absent misconfiguration, leaving POST /v1/recipes/run, /v1/recipes/stream, and /v1/recipes endpoints fully open to unauthenticated callers. No active exploitation is confirmed (not in CISA KEV); vendor-released patch is available in v4.6.58.

Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any process-writable filesystem location by supplying a crafted user_id containing ../ sequences to the FileMemory constructor. All versions of the praisonaiagents pip package below 1.6.58 are affected; the vulnerability exists in the core library's FileMemory class, not an example or optional component. A detailed proof-of-concept is included in the GitHub Security Advisory (GHSA-gxmw-5f7x-6g22), and no public exploit identified at time of analysis beyond that PoC; no CISA KEV listing exists.

PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but never wired into the underlying FastAPI application, leaving POST /agents, POST /agents/{name}, and POST /api/v1/agents/{id}/invoke fully unauthenticated regardless of any key configured by the operator. All versions prior to 4.6.58 are affected, with the flaw present since approximately 4.6.34 when the serve subsystem first shipped. A public proof-of-concept exists per the GHSA advisory; no public exploit identified at time of analysis in CISA KEV, but the zero-authentication network attack surface makes this a high-priority fix for any deployment exposing the serve interface to untrusted networks.

Server-Side Request Forgery in PraisonAI before version 4.6.58 allows unauthenticated remote attackers to force the application server to make HTTP requests to internal network resources, including cloud metadata endpoints (169.254.169.254), loopback services, and RFC 1918 hosts. Two independent bypass paths exist in the Jobs API webhook_url validator: a DNS rebinding path exploiting the TOCTOU gap between validation and request dispatch, and a fail-open condition where socket.gaierror exceptions are silently swallowed, accepting unresolvable domains with no validation at all. A detailed proof-of-concept including curl commands is published in the GHSA advisory; no CISA KEV listing was present at time of analysis.

Unauthorized filesystem mutation in praisonaiagents allows an LLM-controlled agent to rewrite arbitrary on-disk source files by invoking ast_grep_rewrite with dry_run=False, bypassing the @require_approval authorization gate uniformly enforced on every sibling mutation tool in the framework. All praisonaiagents releases prior to 1.6.58 are affected; the vulnerable function is registered as a top-level tool and exposed through the code_intelligence built-in profile. Exploitability is confirmed by a proof-of-concept in GHSA advisory GHSA-cfxv-8fw8-rwpv, and a secondary defect causes the function to return 'No changes made' to the caller even when files were modified, silently concealing the write.

Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller to execute configured agents via POST /agents and POST /agents/{agent_name} despite an operator-supplied --api-key. The FastAPI app created by _create_agents_app() accepts the key at the CLI layer but never applies it as middleware or a route dependency, rendering the documented authentication control entirely inert on those endpoints. A proof-of-concept is included in GHSA-7ww9-85pg-cv4x, and the flaw is fixed in v4.6.58 via an _authorise_request() method that enforces Bearer or X-Auth-Token header validation.

SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users route agent web-fetching functions to internal HTTP services by supplying hostnames - such as 127.0.0.1.nip.io - that pass the static IP blocklist in spider_tools._host_is_blocked() because the function never performs DNS resolution before validation. The affected functions scrape_page, extract_links, crawl, and extract_text are registered as default LLM-callable agent tools, so any agent prompted to retrieve a user-supplied URL will trigger this path; a live proof-of-concept is documented in the GitHub Security Advisory (GHSA-x44h-65qv-cw74), confirming that publicly available exploit code exists. The CVSS scope change (S:C) and high confidentiality impact (C:H) reflect real ability to exfiltrate responses from internal services such as cloud metadata endpoints or localhost-bound APIs.

Memory exhaustion in PraisonAI's MCP HTTP Stream server allows remote unauthenticated attackers to crash the service by flooding the initialize endpoint with requests. Each initialize call unconditionally appends a new dictionary to self._sessions with no eviction: the cleanup routine _cleanup_sessions is defined but has zero call sites in versions prior to 4.6.58, and the configured TTL is stored but never enforced. No public exploit is identified at time of analysis, but the attack requires only standard HTTP tooling against default deployments where no API key is configured.

Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to unauthenticated remote callers, even when operators have explicitly configured an auth_token in ServerConfig. The AgentServer._create_app factory never reads or enforces the configured token, rendering it dead code while /info actively misleads operators by displaying it as masked ('***'), creating a false sense of security. No public exploit code has been identified at time of analysis, and it is not listed in CISA KEV; the fix is confirmed in praisonaiagents 1.6.58.

Server-side request forgery in PraisonAI's web_crawl() function (versions 1.5.128-1.6.57) allows an attacker who can influence URLs processed by agent or tool workflows to exfiltrate responses from internal services, private network hosts, and cloud metadata endpoints such as AWS IAM credential URLs. This is a confirmed patch bypass of the previously disclosed SSRF class in CVE-2026-40160 and GHSA-8f4v-xfm9-3244, exploiting the fact that the httpx fallback client uses follow_redirects=True without revalidating redirect destinations against the original host blocklist. No public exploit code and no CISA KEV active exploitation designation have been identified at time of analysis.

Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe directory to execute arbitrary code as the PraisonAI process user. Affected are praisonai 3.9.26-4.6.57 and praisonaiagents 0.12.12-1.6.57. This is a hardening bypass: the vulnerable sink in Workflow._execute_include() skips the PRAISONAI_ALLOW_TEMPLATE_TOOLS/PRAISONAI_ALLOW_LOCAL_TOOLS opt-in gates and the centralized safe loader that protect all other tools.py autoload paths, making it a distinct variant within an established advisory family. No public exploit or CISA KEV listing has been identified at time of analysis.

Unauthenticated remote command execution in PraisonAI's bundled Claude GitHub Actions workflow (versions before 4.6.40) lets an outside contributor run arbitrary shell code on the CI runner by opening a fork pull request whose branch name contains shell metacharacters and posting an @claude comment. Two compounding flaws enable this: the workflow interpolates the attacker-controlled branch name directly into an unquoted Bash run: block, and it triggers for any @claude comment without verifying the commenter is a trusted collaborator. Because the job runs with a GitHub App token holding write permissions plus OIDC and gh/git access, injected commands can be chained via $GITHUB_PATH into later privileged steps to gain repository write, PR/issue manipulation, or OIDC-token abuse. No public exploit identified at time of analysis.

Arbitrary code execution in PraisonAI (praisonaiagents) before 1.6.78 lets an attacker who can drop a Python file into a plugin directory run their own code. The plugin manager auto-discovers and executes any .py file found in project-level or user-home .praisonai/plugins/ directories at initialization, with no code signing, integrity checks, or sandboxing. VulnCheck reported it under CWE-94; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Path-traversal remote code execution in PraisonAI (mervinpraison/praisonai) before 1.6.78 lets an authenticated agent user abuse SkillTools.run_skill_script(), which executes skill scripts without validating that the supplied path stays inside the intended working directory. Because absolute file paths are accepted, a low-privileged attacker can point the skill runner at any executable script on the host and run it. No public exploit code has been identified and it is not in CISA KEV, but the flaw was reported by VulnCheck and a GitHub Security Advisory (GHSA-c44f-37qr-gw3f) confirms the fix.

Broken authorization in PraisonAI Platform before 0.1.9 lets any authenticated workspace member modify shared label taxonomy and issue-label associations they should not control, renaming and recoloring shared labels and adding or removing labels on issues created by owners or admins. The flaw (CWE-862, missing authorization) stems from label PATCH and issue-label POST/DELETE endpoints trusting workspace membership without enforcing owner/admin role checks. Reported by VulnCheck with a vendor patch available; there is no public exploit identified at time of analysis and it is not in CISA KEV.

OS command execution in PraisonAI before 4.6.78 lets an attacker who can supply a workflow definition escape the inline-Python sandbox and run arbitrary shell commands with the privileges of the agent process. The flaw lives in JobWorkflowExecutor._exec_inline_python(), whose AST-based validation fails to reject `import os` followed by `os.system()`, turning a malicious YAML workflow file into RCE. No public exploit code or CISA KEV listing is identified at time of analysis, though the bypass technique is described in detail in the vendor advisory.

Webhook signature-verification bypass in PraisonAI before 4.6.78 lets unauthenticated attackers forge Svix 'message.received' events when the framework runs in AgentMail webhook mode. Because incoming payloads are trusted without validating the Svix signature (CWE-287), an attacker can POST crafted JSON to the webhook endpoint and cause configured agents to process attacker-chosen sender addresses and message bodies. A vendor patch exists (4.6.78); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Authentication bypass in PraisonAI before 4.6.78 lets a remote, unauthenticated attacker reach the Call API agent-invocation endpoints when the deployment runs with PRAISONAI_CALL_AUTH=disabled. Because the localhost-only safeguard derives the bind host from the client-supplied HTTP Host header, an attacker on the network can send a spoofed 'Host: 127.0.0.1' header to defeat the restriction and both enumerate and invoke registered agents. Vendor patch is available (reported by VulnCheck); no public exploit identified at time of analysis and it is not listed in CISA KEV.

Code injection in PraisonAI before 4.6.78 lets attackers who control deployment configuration achieve arbitrary Python execution because the API-server deployment generator fails to safely encode the deploy.api.host and agents_file values before emitting them into generated Python source (CWE-94). Injected expressions run when the generated API server starts or handles requests, yielding full code execution in the server process. No public exploit is identified at time of analysis; the flaw was reported by VulnCheck and a vendor patch is available.

Server-side request forgery in PraisonAI's web_crawl tool (versions before 1.6.78) allows an authenticated attacker to reach internal HTTP services and exfiltrate their response bodies. The flaw stems from a time-of-check/time-of-use gap: hostnames are validated once but re-resolved at connection time without IP pinning, so DNS rebinding defeats the SSRF allowlist. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the technique is well-documented and the vendor has released a fix in 1.6.78.

PraisonAI's MCP HTTP-stream transport silently skips authentication when no API key is configured at startup, allowing unauthenticated clients to initialize sessions, enumerate tools via tools/list, and invoke arbitrary tools via tools/call. Affected versions are all releases before 4.6.78. Compounding this, the dispatcher passes tool-call arguments directly to handlers without validating them against the advertised inputSchema, meaning a client can supply malformed or out-of-schema arguments to any registered tool. No public exploit code or CISA KEV listing has been identified at the time of analysis.

PraisonAI's tool approval caching mechanism in versions before 1.6.78 allows an attacker who influences an AI agent's behavior within a session to bypass human-in-the-loop oversight by reusing a single user-granted approval across tool calls with entirely different, unreviewed arguments. The flaw (CWE-863: Incorrect Authorization) directly undermines the security boundary that tool approval is designed to enforce, enabling arbitrary file write operations after approval of a benign operation. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog; however, the CVSS 4.0 score of 6.9 with high integrity impact reflects meaningful risk for any deployment relying on tool approval as a control.

Security-policy bypass in PraisonAI before 4.6.78 renders the default Subprocess Sandbox backend inert, so administrator-defined blocked_commands, blocked_paths, blocked_imports, allow_subprocess, and allow_file_write restrictions are silently ignored. Any actor able to feed instructions into a PraisonAI agent can execute arbitrary subprocess commands, read sensitive files, and perform destructive file operations even though an explicit deny policy is configured. Reported by VulnCheck with a CVSS 4.0 base score of 8.7; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Remote code execution in PraisonAI before 1.6.78 allows attackers to run arbitrary Python on the host by manipulating the LLM that drives the CodeAgent component. Because CodeAgent._execute_python() runs LLM-generated code with no AST validation, import restrictions, or sandbox, an attacker who can shape model output via prompt injection can exfiltrate all environment secrets and gain full control of the agent host. VulnCheck reports the flaw with a maximum CVSS 4.0 score of 10.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Root-level command execution and arbitrary file write in PraisonAI's AICoder component (all versions before 4.6.78) let an attacker with chat-interface access weaponize LLM tool calls: because file paths are not validated and shell commands are not sanitized, a crafted prompt can write files anywhere on the host and run arbitrary shell commands as root. Reported by VulnCheck and fixed in 4.6.78, this is a CVSS 9.4 (v4.0) flaw with no public exploit identified at time of analysis, though the injection path is trivial to trigger for any user who can reach the chat.

Broken authorization in PraisonAI Platform (praisonai-platform) before 0.1.9 lets any low-privileged workspace member modify owner- or admin-created projects, issues, and agents because the PATCH routes only check for workspace-member role instead of owner/admin. Because a member can reassign a project's lead_id to their own user id, they can then satisfy and bypass the delete route's owner/admin check to destroy owner-created projects. No public exploit identified at time of analysis, though the flaw is trivially reachable by any authenticated tenant member.

System prompt extraction and unauthorized tool invocation in PraisonAI before 4.6.78 arise because the prompt-injection defense ships with its blocking threshold defaulting to CRITICAL, so HIGH-severity injection attempts are detected and logged but never blocked. Any remote user interacting with a PraisonAI agent can submit single-vector prompt injection (instruction overrides, financial manipulation) that scores HIGH and passes through, leaking the system prompt and triggering agent tools without authorization. No public exploit identified at time of analysis, and the issue is not in CISA KEV; the vendor CVSS 4.0 score is 8.7 (High).

Server-side request forgery in PraisonAI's Crawl4AI/Chromium crawling backend (all versions before 1.6.78) lets low-privileged users bypass URL allowlist/SSRF validation through DNS rebinding and HTTP redirects, causing the headless browser to reach internal-only services and return their responses. Because validation happens before the browser dereferences the URL, an attacker-controlled host can pass the check and then resolve or redirect to internal endpoints, exposing sensitive internal data (demonstrated with canary values). Reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Webhook signature verification is absent in PraisonAI AgentMail before version 4.6.78, permitting any unauthenticated network attacker to POST crafted message.received events directly to the webhook endpoint with spoofed sender identities. This bypasses configured sender allow/block lists, injecting arbitrary content into the AI agent's processing pipeline and causing the agent to dispatch replies to attacker-controlled addresses. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog, though the low-complexity, unauthenticated attack vector makes exploitation straightforward for any attacker with network access to the webhook endpoint.

Unauthenticated agent access in PraisonAI before 1.7.3 lets remote attackers read agent instructions and system prompts and directly invoke agents because the server ships with insecure defaults - binding to all network interfaces (0.0.0.0), enforcing no API key, and allowing wildcard CORS. Any attacker who can reach the service can call GET /api/agents to exfiltrate proprietary prompt logic or POST /api/chat to abuse the agents without credentials. There is no public exploit identified at time of analysis, but exploitation is trivial and requires no special tooling given the missing authentication.

SQL/CQL injection in PraisonAI's PGVector and Cassandra knowledge-store backends before 4.6.78 allows a caller who controls the create_collection() dimension argument to inject arbitrary database tokens. Although the code validates schema, keyspace, and collection-name identifiers, the dimension value - typed as int but never enforced at runtime - is string-interpolated directly into the vector column of the generated CREATE TABLE DDL, so a payload like '3); DROP TABLE tenant_secrets; --' executes against the backing database. No public exploit identified at time of analysis; the flaw was reported by VulnCheck and a vendor patch is available.

Path traversal in PraisonAI before 4.6.78 enables file exfiltration outside the workspace by embedding traversal sequences (e.g., @../outside_secret.txt) or absolute paths in custom project command templates, which are then injected verbatim into model prompts. Users who process attacker-controlled command files expose all process-readable files - including credentials, environment variables, and application secrets - to whoever controls the model interaction. No public exploit code has been identified and PraisonAI is not listed in the CISA KEV catalog at time of analysis; a vendor patch is available.

Remote code execution in PraisonAI before 4.6.78 lets an attacker who can supply the agents_file parameter to deploy/api.py run arbitrary Python, because that value is interpolated directly into an f-string that is later executed as generated server code via subprocess.Popen(). The CVSS 4.0 base score is 9.4 and the vector requires high privileges (PR:H), meaning the attacker must already be able to reach and drive the deployment API. No public exploit has been identified at time of analysis and it is not on the CISA KEV list.

Broken authorization in PraisonAI Platform before 0.1.9 lets an authenticated workspace member delete owner-created issue dependencies they should not be able to remove. The DELETE dependency route accepts either endpoint of a dependency edge and validates delete permission only against the caller-supplied issue URL, so a member blocked (403) via the owner's issue endpoint can delete the same edge by targeting their own member-owned issue endpoint. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis and it is not on CISA KEV.

Arbitrary Python code execution in PraisonAI (praisonaiagents) before 1.6.78 occurs when AgentFlow._resolve_pydantic_class resolves a string output_pydantic reference in a workflow step, causing the framework to import a sibling tools.py from the workflow file's directory via importlib exec_module without any sandboxing. Because this loader ignores the PRAISONAI_ALLOW_*_TOOLS environment guardrails, an attacker who supplies a malicious workflow file plus its tools.py runs code with the workflow runner's privileges the moment the workflow is executed via WorkflowManager or loaded through load_yaml. No public exploit is identified at time of analysis, and the flaw is not listed in CISA KEV.

Command execution allowlist bypass in PraisonAI before 4.6.78 lets a low-privileged attacker who can supply commands to the framework's restricted-execution feature slip past its shell-metacharacter filters by abusing find's built-in -exec, -execdir, and -delete actions. Because those actions run binaries and delete files entirely inside the find process, they never trip the metacharacter allowlist, so the attacker can read blocked files, delete arbitrary files, and launch non-allowlisted binaries. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 4.0 base score of 8.7 (High) reflects full loss of confidentiality, integrity, and availability of the affected system.

Path traversal in PraisonAI's FastContext feature (praisonaiagents before 1.6.78) enables low-privileged network attackers to read arbitrary files outside the intended workspace sandbox. FastContextAgent.execute_tool() applies the workspace_path prefix only to relative paths, neither rejecting absolute path arguments nor canonicalizing joined paths before enforcing containment - meaning file-operation tools (grep_search, glob_search, read_file, list_directory) can be exploited with '../' sequences or direct absolute paths to exfiltrate host files. No public exploit has been identified at time of analysis, but the vulnerability is straightforward to trigger given the mechanics, and CVSS 4.0 rates the confidentiality impact on the vulnerable system as High.

Path traversal in PraisonAI's ContextGatherer component (all versions before 4.6.78) allows an attacker who can supply or manipulate .praisoncontext or .praisoninclude files to read arbitrary files outside the intended workspace directory, including sensitive system files accessible to the user running PraisonAI. The vulnerability stems from a complete absence of path validation before file inclusion, permitting both absolute paths and relative traversal sequences. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis; however, the attack is conceptually simple and requires no special tooling once an attacker can influence project workspace files.

Unauthenticated blind SSRF via DNS rebinding in PraisonAI before 4.6.78 allows remote attackers to reach internal services through the Jobs API /api/v1/runs endpoint without credentials. The webhook_url parameter is validated at request intake but re-resolved at connection time, creating a TOCTOU window exploitable by an attacker who controls a malicious DNS server - flipping the resolved IP from a legitimate external address to an internal target after validation passes. No public exploit code or CISA KEV listing exists at time of analysis; the unauthenticated network vector (AV:N/PR:N) makes this a meaningful risk for any internet-exposed PraisonAI deployment, particularly in cloud environments where internal metadata APIs may be reachable.

Path traversal in PraisonAI (pip package praisonaiagents) before version 1.6.78 allows an untrusted checked-out repository to overwrite arbitrary files on a developer's machine by embedding a malicious `.praisonai/config.toml` that sets `defaults.output.output_file` to an absolute or directory-traversal path. When the developer subsequently constructs an Agent and calls `agent.start()` without an explicit output parameter, PraisonAI resolves the attacker-supplied path - creating parent directories as needed - and writes agent output there with the privileges of the running user. No public exploit code or CISA KEV listing has been identified; a vendor patch at version 1.6.78 and an upstream fix commit are available per GitHub Security Advisory GHSA-qjw5-xwrp-xwpq.

Prompt injection defenses in PraisonAI before version 4.6.78 can be bypassed by crafting single or double-vector injections classified at the HIGH threat level, which the protection mechanism silently allows through to the underlying language model. The defense only blocks CRITICAL-classified injections - those matching three or more detector families simultaneously - meaning attackers who deliberately keep their payload below that threshold face no blocking at all. No active exploitation has been confirmed via CISA KEV and no public exploit code has been identified at time of analysis, though the bypass technique is conceptually straightforward given that the classification threshold logic is now publicly disclosed.

Cross-tenant authorization bypass in PraisonAI before 0.1.7 allows authenticated users to inject issues into projects belonging to other workspaces by supplying an unvalidated project_id in issue create and update request bodies. The server trusts the client-supplied project_id without verifying it belongs to the workspace identified in the URL, a classic IDOR pattern classified under CWE-639. An attacker can corrupt project statistics aggregation across tenant boundaries, undermining data integrity in multi-tenant deployments. No public exploit code has been identified at time of analysis, and this is not listed in the CISA KEV catalog.

Path traversal in PraisonAI's MultiAgentMonitor component (versions <= 1.5.114) lets remote attackers who can supply agent identifiers read, write, or overwrite arbitrary files on the host by embedding '../' sequences in agent IDs. The flaw, disclosed by VulnCheck and tracked as GHSA-766v-q9x3-g744, enables information disclosure, denial of service, and potential code execution in multi-agent AI deployments; no public exploit identified at time of analysis but a detailed PoC is included in the advisory.

Information disclosure in PraisonAI before 1.5.115 allows authenticated agents to read other agents' system prompts and conversation history by exploiting missing uniqueness enforcement on agent identifiers in the MultiAgentLedger component. An attacker who can register an agent with a colliding ID receives the same ledger instance as the victim, breaking tenant isolation in multi-agent deployments. No public exploit identified at time of analysis, though the upstream GHSA advisory (GHSA-766v-q9x3-g744) publishes a working proof-of-concept demonstrating the collision.

Cross-origin agent execution in PraisonAI's AGUI endpoint allows any attacker-controlled website to silently invoke locally-running agents and exfiltrate their streaming responses, including tool execution results and sensitive environment data. The flaw stems from a triad of issues - no authentication on POST /agui, a hardcoded wildcard CORS header, and Starlette's Content-Type-agnostic JSON parsing - that together let a simple cross-origin request bypass the browser's preflight check. No public exploit identified at time of analysis, but the GHSA advisory publishes a complete attack flow making weaponization trivial.

Arbitrary shell command execution in PraisonAI before 4.5.128 allows authenticated UI users to bypass the human-in-the-loop approval gate because the Chainlit chat and code UI modules hardcode approval_mode='auto' after loading administrator config from PRAISON_APPROVAL_MODE. Once auto-approved, prompts to the LLM agent reach subprocess.run with shell=True, and the existing blocklists only filter command chaining operators - leaving single destructive commands (rm -rf, curl, dd, chmod) executable. No public exploit identified at time of analysis beyond the vendor PoC; not currently listed in CISA KEV.

Tool approval cache bypass in PraisonAI Agents (praisonaiagents < 4.5.128) allows an LLM agent to execute arbitrary subsequent shell commands without user consent after a single initial approval. The approval system caches decisions keyed only on tool name - once a user approves `execute_command` for any command (e.g., `ls -la`), all further `execute_command` invocations in that agent session bypass the approval prompt entirely. Combined with `os.environ.copy()` passing the full process environment to every subprocess, this enables silent exfiltration of API keys and credentials; a publicly available proof-of-concept is included in the GHSA advisory. No confirmed active exploitation in CISA KEV at time of analysis.

Path traversal via symlink exploitation in PraisonAI multi-agent teams system allows remote unauthenticated attackers to write arbitrary files outside intended directories during recipe operations (pull/publish/unpack). The _safe_extractall helper validates archive member names but fails to validate symlink targets (linkname attribute), enabling attackers to craft malicious tar bundles containing symlinks pointing outside extraction directories followed by files traversing through those symlinks. Affects versions prior to 4.6.37. EPSS data unavailable, no CISA KEV listing, and no public POC identified at time of analysis, suggesting limited observed exploitation despite network-accessible attack vector.

Remote attackers can invoke arbitrary application callables in PraisonAI multi-agent systems by manipulating tool-call names to bypass tool declaration controls. Vulnerable versions (praisonai <4.6.37, praisonaiagents <1.6.37) resolve unmatched tool names against module globals and __main__ namespaces without permission validation when _perm_allow is None (default configuration). This enables unauthorized function execution beyond the intended tool list, allowing integrity compromise and potential information disclosure. Patched versions 4.6.37 and 1.6.37 address the tool name resolution vulnerability.

SQL and CQL injection vulnerability in PraisonAI multi-agent teams system versions 2.4.1 through 4.6.33 allows authenticated attackers to execute arbitrary SQL or CQL commands by injecting malicious collection names into knowledge-store implementations. The vulnerability affects applications that pass untrusted collection names to optional SQL/CQL-backed storage backends, enabling data exfiltration, modification, or deletion with low complexity exploitation.

Unauthenticated remote session hijacking in PraisonAI's browser bridge (versions <4.5.139) and praisonaiagents (<1.5.140) allows network attackers to control browser automation sessions without authentication. The /ws WebSocket endpoint accepts connections from any client omitting the Origin header, enabling attackers to send start_session commands that hijack idle browser-extension sessions and receive all automation outputs. With CVSS 9.1 (Critical) scoring driven by network attack vector, low complexity, and no authentication requirement (AV:N/AC:L/PR:N), this represents a severe risk in any deployment where the default 0.0.0.0 binding exposes the service to untrusted networks. No public exploit identified at time of analysis, though exploitation requires only basic WebSocket client capabilities.

SQL identifier injection in PraisonAI's SQLiteConversationStore allows authenticated local attackers with configuration control to extract database schema and manipulate query results. The vulnerability affects PraisonAI versions prior to 4.5.133, where unsanitized table_prefix values are concatenated into SQL queries via f-strings. Attackers controlling configuration inputs (from_yaml/from_dict) can inject SQL fragments to access internal SQLite tables like sqlite_master and execute UNION-based injections. A vendor patch is available in version 4.5.133. No public exploit code or active exploitation confirmed at time of analysis. CVSS 7.2 indicates local attack vector with low complexity but requires low privileges and present attack complexity conditions.

Path traversal in PraisonAI multi-agent teams system (versions prior to 4.5.128) enables arbitrary file overwrite through malicious .praison archive bundles. The cmd_unpack function in recipe CLI performs unvalidated tar extraction, allowing attackers to embed ../ path sequences that escape the intended extraction directory. Unauthenticated attackers can distribute weaponized bundles that, when unpacked by victims via 'praisonai recipe unpack' command, overwrite critical system files with attacker-controlled content. No public exploit identified at time of analysis.

Arbitrary code execution occurs in PraisonAI (all versions prior to 4.5.128) when a malicious tools.py file exists in the working directory. The framework automatically imports and executes this file during startup without validation or user consent, enabling unauthenticated local attackers to execute arbitrary Python code by placing a weaponized tools.py in directories accessed by users or CI/CD pipelines. User interaction is required (running praisonai command). No public exploit identified at time of analysis.

Remote code execution in PraisonAI multi-agent framework (versions prior to 4.5.128) allows unauthenticated attackers to execute arbitrary code via malicious template files fetched from remote sources. The framework downloads and executes template files without integrity verification, origin validation, or user confirmation, creating a supply chain attack vector. Attackers with network access can distribute weaponized templates that execute when retrieved by victims, achieving high confidentiality and integrity compromise with scope change. No public exploit identified at time of analysis.

PraisonAI AgentOS prior to version 4.5.128 exposes agent metadata including names, roles, and system instruction snippets via an unauthenticated GET /api/agents endpoint accessible from any network origin due to missing authentication middleware and permissive CORS defaults. This information disclosure vulnerability allows remote attackers to enumerate agent configurations without credentials, potentially revealing sensitive operational details that could inform social engineering or reconnaissance attacks against multi-agent deployments.

Unauthenticated modification of the tool approval allowlist in PraisonAI multi-agent system (versions prior to 4.5.128) enables attackers to bypass human-in-the-loop safety controls by injecting dangerous tool names (shell_exec, file_write) into the allowlist via the /api/approval/allow-list gateway endpoint. The ExecApprovalManager then auto-approves agent invocations of these tools, circumventing the approval mechanism's core security function. Attack requires local access; no public exploit identified at time of analysis. CVSS 7.9 reflects high integrity impact with scope change due to compromised safety boundaries in agent workflows.

Disk exhaustion in PraisonAI prior to 4.5.128 allows remote attackers to consume arbitrary disk space by publishing malicious recipe bundles containing highly compressible data that expand dramatically during extraction. The vulnerability exists in the _safe_extractall() function, which validates only path traversal attacks but lacks checks on individual member sizes, cumulative extracted size, or member count before tar extraction, enabling an unauthenticated attacker to trigger denial of service via LocalRegistry.pull() or HttpRegistry.pull() with minimal user interaction.

Unauthenticated resource exhaustion in PraisonAI versions prior to 4.5.128 allows remote attackers to drain OpenAI API credits and exhaust server resources. The /media-stream WebSocket endpoint in the call module accepts connections without authentication or Twilio signature validation, enabling unlimited concurrent sessions to OpenAI's Realtime API using the server's credentials. No public exploit identified at time of analysis. Affects PraisonAI deployments exposing the call module's WebSocket interface.

Memory exhaustion denial of service in PraisonAI's WSGI-based recipe registry server (server.py) affects versions prior to 4.5.128. The vulnerability allows unauthenticated local processes to send arbitrarily large POST requests by spoofing the Content-Length header, causing the server to allocate unbounded memory and crash. Authentication is disabled by default, eliminating any access control barrier. The Starlette-based alternative server (serve.py) includes a 10MB request size limit, but the WSGI implementation lacks equivalent protection. Vendor-released patch: version 4.5.128 or later.

Server-Side Request Forgery in PraisonAI versions prior to 4.5.128 allows unauthenticated remote attackers to force the server to send HTTP POST requests to arbitrary internal or external destinations via an unvalidated webhook_url parameter in the /api/v1/runs endpoint. Attackers can abuse this to access cloud metadata services (AWS/GCP/Azure instance metadata), internal APIs, and network-adjacent services, potentially exposing credentials, configuration data, or triggering unauthorized actions. No public exploit identified at time of analysis. CVSS 7.2 indicates changed scope with low confidentiality and integrity impact.

Environment variable injection in PraisonAI deploy.py (versions prior to 4.5.128) allows authenticated local attackers to inject arbitrary environment variables into Google Cloud Run services during deployment. The vulnerability stems from improper validation of comma-separated gcloud CLI arguments, enabling attackers to manipulate openai_model, openai_key, or openai_base parameters with embedded commas, causing gcloud to parse injected content as additional KEY=VALUE pairs. This grants high-level access to confidential service configuration and permits unauthorized modifications. No public exploit identified at time of analysis.