Praisonai
Monthly
Prompt injection defenses in PraisonAI before version 4.6.78 can be bypassed by crafting single or double-vector injections classified at the HIGH threat level, which the protection mechanism silently allows through to the underlying language model. The defense only blocks CRITICAL-classified injections - those matching three or more detector families simultaneously - meaning attackers who deliberately keep their payload below that threshold face no blocking at all. No active exploitation has been confirmed via CISA KEV and no public exploit code has been identified at time of analysis, though the bypass technique is conceptually straightforward given that the classification threshold logic is now publicly disclosed.
Cross-tenant authorization bypass in PraisonAI before 0.1.7 allows authenticated users to inject issues into projects belonging to other workspaces by supplying an unvalidated project_id in issue create and update request bodies. The server trusts the client-supplied project_id without verifying it belongs to the workspace identified in the URL, a classic IDOR pattern classified under CWE-639. An attacker can corrupt project statistics aggregation across tenant boundaries, undermining data integrity in multi-tenant deployments. No public exploit code has been identified at time of analysis, and this is not listed in the CISA KEV catalog.
Tool approval cache bypass in PraisonAI Agents (praisonaiagents < 4.5.128) allows an LLM agent to execute arbitrary subsequent shell commands without user consent after a single initial approval. The approval system caches decisions keyed only on tool name - once a user approves `execute_command` for any command (e.g., `ls -la`), all further `execute_command` invocations in that agent session bypass the approval prompt entirely. Combined with `os.environ.copy()` passing the full process environment to every subprocess, this enables silent exfiltration of API keys and credentials; a publicly available proof-of-concept is included in the GHSA advisory. No confirmed active exploitation in CISA KEV at time of analysis.
SQL and CQL injection vulnerability in PraisonAI multi-agent teams system versions 2.4.1 through 4.6.33 allows authenticated attackers to execute arbitrary SQL or CQL commands by injecting malicious collection names into knowledge-store implementations. The vulnerability affects applications that pass untrusted collection names to optional SQL/CQL-backed storage backends, enabling data exfiltration, modification, or deletion with low complexity exploitation.
PraisonAI before version 4.5.128 exposes sensitive environment variables to untrusted subprocess commands executed through its MCP (Model Context Protocol) integration, enabling credential theft and supply chain attacks when third-party tools like npx packages are invoked. An unauthenticated local attacker with user interaction can trigger MCP commands that inherit the parent process environment, gaining access to API keys, authentication tokens, and database credentials without the knowledge of developers using PraisonAI. The vulnerability is fixed in version 4.5.128.
PraisonAI AgentOS prior to version 4.5.128 exposes agent metadata including names, roles, and system instruction snippets via an unauthenticated GET /api/agents endpoint accessible from any network origin due to missing authentication middleware and permissive CORS defaults. This information disclosure vulnerability allows remote attackers to enumerate agent configurations without credentials, potentially revealing sensitive operational details that could inform social engineering or reconnaissance attacks against multi-agent deployments.
Disk exhaustion in PraisonAI prior to 4.5.128 allows remote attackers to consume arbitrary disk space by publishing malicious recipe bundles containing highly compressible data that expand dramatically during extraction. The vulnerability exists in the _safe_extractall() function, which validates only path traversal attacks but lacks checks on individual member sizes, cumulative extracted size, or member count before tar extraction, enabling an unauthenticated attacker to trigger denial of service via LocalRegistry.pull() or HttpRegistry.pull() with minimal user interaction.
Memory exhaustion denial of service in PraisonAI's WSGI-based recipe registry server (server.py) affects versions prior to 4.5.128. The vulnerability allows unauthenticated local processes to send arbitrarily large POST requests by spoofing the Content-Length header, causing the server to allocate unbounded memory and crash. Authentication is disabled by default, eliminating any access control barrier. The Starlette-based alternative server (serve.py) includes a 10MB request size limit, but the WSGI implementation lacks equivalent protection. Vendor-released patch: version 4.5.128 or later.
Stored cross-site scripting (XSS) in PraisonAI versions prior to 4.5.128 allows remote attackers to inject arbitrary JavaScript into agent output rendered by the Flask API endpoint. The vulnerability exists because the _sanitize_html function depends on the nh3 library, which is not declared as a required dependency in pyproject.toml; when nh3 is absent (default installation), HTML sanitization becomes a no-op. Attackers can exploit this via RAG data poisoning, malicious web scraping results, or prompt injection to execute malicious scripts in the browsers of users viewing API output. No public exploit code or active exploitation has been confirmed.
Prompt injection defenses in PraisonAI before version 4.6.78 can be bypassed by crafting single or double-vector injections classified at the HIGH threat level, which the protection mechanism silently allows through to the underlying language model. The defense only blocks CRITICAL-classified injections - those matching three or more detector families simultaneously - meaning attackers who deliberately keep their payload below that threshold face no blocking at all. No active exploitation has been confirmed via CISA KEV and no public exploit code has been identified at time of analysis, though the bypass technique is conceptually straightforward given that the classification threshold logic is now publicly disclosed.
Cross-tenant authorization bypass in PraisonAI before 0.1.7 allows authenticated users to inject issues into projects belonging to other workspaces by supplying an unvalidated project_id in issue create and update request bodies. The server trusts the client-supplied project_id without verifying it belongs to the workspace identified in the URL, a classic IDOR pattern classified under CWE-639. An attacker can corrupt project statistics aggregation across tenant boundaries, undermining data integrity in multi-tenant deployments. No public exploit code has been identified at time of analysis, and this is not listed in the CISA KEV catalog.
Tool approval cache bypass in PraisonAI Agents (praisonaiagents < 4.5.128) allows an LLM agent to execute arbitrary subsequent shell commands without user consent after a single initial approval. The approval system caches decisions keyed only on tool name - once a user approves `execute_command` for any command (e.g., `ls -la`), all further `execute_command` invocations in that agent session bypass the approval prompt entirely. Combined with `os.environ.copy()` passing the full process environment to every subprocess, this enables silent exfiltration of API keys and credentials; a publicly available proof-of-concept is included in the GHSA advisory. No confirmed active exploitation in CISA KEV at time of analysis.
SQL and CQL injection vulnerability in PraisonAI multi-agent teams system versions 2.4.1 through 4.6.33 allows authenticated attackers to execute arbitrary SQL or CQL commands by injecting malicious collection names into knowledge-store implementations. The vulnerability affects applications that pass untrusted collection names to optional SQL/CQL-backed storage backends, enabling data exfiltration, modification, or deletion with low complexity exploitation.
PraisonAI before version 4.5.128 exposes sensitive environment variables to untrusted subprocess commands executed through its MCP (Model Context Protocol) integration, enabling credential theft and supply chain attacks when third-party tools like npx packages are invoked. An unauthenticated local attacker with user interaction can trigger MCP commands that inherit the parent process environment, gaining access to API keys, authentication tokens, and database credentials without the knowledge of developers using PraisonAI. The vulnerability is fixed in version 4.5.128.
PraisonAI AgentOS prior to version 4.5.128 exposes agent metadata including names, roles, and system instruction snippets via an unauthenticated GET /api/agents endpoint accessible from any network origin due to missing authentication middleware and permissive CORS defaults. This information disclosure vulnerability allows remote attackers to enumerate agent configurations without credentials, potentially revealing sensitive operational details that could inform social engineering or reconnaissance attacks against multi-agent deployments.
Disk exhaustion in PraisonAI prior to 4.5.128 allows remote attackers to consume arbitrary disk space by publishing malicious recipe bundles containing highly compressible data that expand dramatically during extraction. The vulnerability exists in the _safe_extractall() function, which validates only path traversal attacks but lacks checks on individual member sizes, cumulative extracted size, or member count before tar extraction, enabling an unauthenticated attacker to trigger denial of service via LocalRegistry.pull() or HttpRegistry.pull() with minimal user interaction.
Memory exhaustion denial of service in PraisonAI's WSGI-based recipe registry server (server.py) affects versions prior to 4.5.128. The vulnerability allows unauthenticated local processes to send arbitrarily large POST requests by spoofing the Content-Length header, causing the server to allocate unbounded memory and crash. Authentication is disabled by default, eliminating any access control barrier. The Starlette-based alternative server (serve.py) includes a 10MB request size limit, but the WSGI implementation lacks equivalent protection. Vendor-released patch: version 4.5.128 or later.
Stored cross-site scripting (XSS) in PraisonAI versions prior to 4.5.128 allows remote attackers to inject arbitrary JavaScript into agent output rendered by the Flask API endpoint. The vulnerability exists because the _sanitize_html function depends on the nh3 library, which is not declared as a required dependency in pyproject.toml; when nh3 is absent (default installation), HTML sanitization becomes a no-op. Attackers can exploit this via RAG data poisoning, malicious web scraping results, or prompt injection to execute malicious scripts in the browsers of users viewing API output. No public exploit code or active exploitation has been confirmed.