Praisonaiagents
Monthly
Unauthenticated remote agent enumeration and invocation in PraisonAI's AgentTeam.launch() / Agents.launch() HTTP server lets any client that can reach the listening port list deployed agents and trigger agent.chat() calls, burning model resources, reaching connected private context, and firing agent tools and workflow side effects. The affected artifact is the Python package praisonaiagents before 1.6.59, whose FastAPI server binds to 0.0.0.0 by default and accepts requests with no Authorization header - or even with an obviously wrong bearer token. Vendor-released patch: praisonaiagents 1.6.59 (PraisonAI v4.6.59); no public exploit identified at time of analysis, and the practical limiting factor is deployment: the routes are only remotely reachable if launch() is actually started and network-exposed rather than bound to localhost or placed behind an authenticating proxy.
Server-side request forgery in the SearxNG-backed search tools shipped with the praisonaiagents Python package before 1.6.62 lets prompt-injected content hijack the agent's outbound HTTP requests and read the responses back into the model's context, enabling internal service and API disclosure plus internal host/port enumeration. The vulnerable sink is the LLM-exposed searxng_url tool parameter, which is forwarded to requests.get() without any validation of scheme, host, port, or resolved address; search_web and searxng_search are part of the default agent tool profile, so any agent that ingests attacker-controlled web pages, files, or upstream tool output is in scope. The CVSS vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L (8.8) - no authentication is needed (PR:N), but exploitation depends on the agent actually processing malicious content and the model complying with the injected tool call (UI:R); confidential impact is high while integrity and availability impact are low. No public exploit identified at time of analysis; in cloud deployments the same primitive can reach the instance metadata endpoint (169.254.169.254) and potentially expose IAM credentials, though that requires the instance metadata service to be reachable from the agent's network position.
Unauthenticated MCP tool invocation in PraisonAI (praisonaiagents 0.6.0–1.6.58 and praisonai 3.10.0–4.6.58) lets a malicious website use DNS rebinding to reach a local or internal ToolsMCPServer SSE endpoint on /sse and /messages/, enumerate registered tools, and invoke them with the server user's privileges. The legacy SSE wrapper performs no Host, Origin, or authentication enforcement, while the newer Streamable HTTP transport rejects the same hostile Origin with HTTP 403, isolating the flaw to the legacy SSE path. An initial remediation ships in praisonaiagents
Unauthenticated tool invocation and potential remote code execution in PraisonAI Agents (praisonaiagents) before 1.6.59, where the MCP SSE transport started by ToolsMCPServer.run_sse() or launch_tools_mcp_server(transport='sse') binds to 0.0.0.0 and builds its Starlette application with no authentication middleware and no Origin validation. Any client that can reach the listening port (default 8080) can list and invoke every registered tool without credentials, and because the bundled SecurityConfig, origin-validation and DNS-rebinding checks in mcp/mcp_security.py are never called, a malicious web page can rebind a hostname to 127.0.0.1 and drive the same JSON-RPC calls against a developer's local instance; the practical impact scales with the registered toolset and becomes full RCE where file, shell, or code-execution tools are exposed. Exposure is gated on an operator actually launching the SSE transport - merely importing the library is not sufficient - and no public exploit code has been identified at time of analysis (EPSS 0.47%, SSVC exploitation: none), with a vendor patch available in 1.6.59.
IMAP command injection in the PraisonAI praisonaiagents email tools before 1.6.59 lets LLM-controlled arguments (from_addr, subject, query, message_id) break out of quoted IMAP SEARCH criteria and inject arbitrary IMAP commands, giving access to, modification of, or deletion of mailbox data. Exploitation requires an agent deployed with email credentials configured (EMAIL_ADDRESS and EMAIL_PASSWORD) and with the search_emails, reply_email, or archive_email tools exposed, plus an attacker able to steer the tool-call arguments — typically via crafted or indirect prompt injection reaching the agent. The advisory includes a static proof-of-concept data-flow trace, and CISA's SSVC assessment records exploitation status as 'poc'; the flaw is not listed in CISA KEV, and no EPSS score was supplied.
Unauthenticated remote code execution in the PraisonAI multi-agent framework lets any network-reachable caller run arbitrary operating-system commands on servers exposing the Jobs API. The attack chains two defects: the POST /api/v1/runs endpoint ships without the verify_token dependency used by the authenticated agent_invoke endpoint (PR:N, no credentials or session required), and an attacker-supplied top-level 'approve' field in the submitted agent_yaml is loaded into a ContextVar that the @require_approval decorator consults before any risk-level check, so listing 'execute_command' makes the critical-tool approval gate a no-op with no operator interaction (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-306). Affected releases are praisonai through 4.6.48 and praisonaiagents prior to 1.6.59, both fixed in 4.6.59 and 1.6.59 respectively; publicly available exploit code exists (a curl-based PoC is published in the GHSA advisory) and CISA's SSVC assessment rates the issue automatable with total technical impact, although no confirmed active exploitation (CISA KEV) has been reported and the current EPSS score is low at 0.41% (35th percentile).
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users route agent web-fetching functions to internal HTTP services by supplying hostnames - such as 127.0.0.1.nip.io - that pass the static IP blocklist in spider_tools._host_is_blocked() because the function never performs DNS resolution before validation. The affected functions scrape_page, extract_links, crawl, and extract_text are registered as default LLM-callable agent tools, so any agent prompted to retrieve a user-supplied URL will trigger this path; a live proof-of-concept is documented in the GitHub Security Advisory (GHSA-x44h-65qv-cw74), confirming that publicly available exploit code exists. The CVSS scope change (S:C) and high confidentiality impact (C:H) reflect real ability to exfiltrate responses from internal services such as cloud metadata endpoints or localhost-bound APIs.
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to unauthenticated remote callers, even when operators have explicitly configured an auth_token in ServerConfig. The AgentServer._create_app factory never reads or enforces the configured token, rendering it dead code while /info actively misleads operators by displaying it as masked ('***'), creating a false sense of security. No public exploit code has been identified at time of analysis, and it is not listed in CISA KEV; the fix is confirmed in praisonaiagents 1.6.58.
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe directory to execute arbitrary code as the PraisonAI process user. Affected are praisonai 3.9.26-4.6.57 and praisonaiagents 0.12.12-1.6.57. This is a hardening bypass: the vulnerable sink in Workflow._execute_include() skips the PRAISONAI_ALLOW_TEMPLATE_TOOLS/PRAISONAI_ALLOW_LOCAL_TOOLS opt-in gates and the centralized safe loader that protect all other tools.py autoload paths, making it a distinct variant within an established advisory family. No public exploit or CISA KEV listing has been identified at time of analysis.
Remote attackers can invoke arbitrary application callables in PraisonAI multi-agent systems by manipulating tool-call names to bypass tool declaration controls. Vulnerable versions (praisonai <4.6.37, praisonaiagents <1.6.37) resolve unmatched tool names against module globals and __main__ namespaces without permission validation when _perm_allow is None (default configuration). This enables unauthorized function execution beyond the intended tool list, allowing integrity compromise and potential information disclosure. Patched versions 4.6.37 and 1.6.37 address the tool name resolution vulnerability.
SQL injection in PraisonAI's multi-backend conversation storage system allows authenticated attackers to execute arbitrary SQL commands. The incomplete fix for CVE-2026-40315 validated input only in SQLiteConversationStore, leaving nine other database backends (MySQL, PostgreSQL, Turso, SingleStore, Supabase, SurrealDB, and their async variants) vulnerable to f-string SQL injection via unvalidated table_prefix and schema parameters. 52 injection points exist across the codebase. Exploitable in multi-tenant deployments or API-driven configurations where table_prefix is derived from external input. Patches released in praisonai 4.6.9 and praisonaiagents 1.6.9 address all affected backends. EPSS and KEV data unavailable; no public POC confirmed at time of analysis.
Unauthenticated remote session hijacking in PraisonAI's browser bridge (versions <4.5.139) and praisonaiagents (<1.5.140) allows network attackers to control browser automation sessions without authentication. The /ws WebSocket endpoint accepts connections from any client omitting the Origin header, enabling attackers to send start_session commands that hijack idle browser-extension sessions and receive all automation outputs. With CVSS 9.1 (Critical) scoring driven by network attack vector, low complexity, and no authentication requirement (AV:N/AC:L/PR:N), this represents a severe risk in any deployment where the default 0.0.0.0 binding exposes the service to untrusted networks. No public exploit identified at time of analysis, though exploitation requires only basic WebSocket client capabilities.
Arbitrary command and code execution in PraisonAI's workflow engine (versions <4.5.139) and praisonaiagents (<1.5.140) allows remote unauthenticated attackers to execute shell commands and Python code through malicious YAML workflow files. The vulnerability stems from unsafe processing of 'run:', 'script:', and 'python:' directives in job-type workflows without validation or sandboxing. With a critical CVSS score of 9.8 and network-accessible attack vector requiring no privileges or user interac
Arbitrary Python code execution in PraisonAI ≤4.5.138 occurs when malicious tools.py files are automatically imported from the current working directory without validation. Attackers placing a crafted tools.py in shared projects, cloned repositories, or writable workspaces achieve immediate code execution with full process privileges upon PraisonAI startup. EPSS data not available, but the local attack vector (AV:L) requiring no privileges (PR:N) or user interaction (UI:N) enables exploitation through supply chain and workspace poisoning attacks. No public exploit identified at time of analysis, though the vulnerability is trivial to exploit given the straightforward code injection mechanism.
Server-Side Request Forgery (SSRF) in PraisonAIAgents versions prior to 1.5.128 allows unauthenticated attackers to manipulate LLM agents into crawling arbitrary internal URLs. The httpx fallback crawler accepts user-supplied URLs without host validation and follows redirects, enabling access to cloud metadata endpoints (169.254.169.254), internal services, and localhost. Response content is returned to the agent and may be exposed in attacker-visible output. This vulnerability is the default behavior on fresh installations without Tavily API keys or Crawl4AI dependencies. No public exploit identified at time of analysis.
Environment variable exfiltration in PraisonAIAgents versions prior to 1.5.128 allows unauthenticated remote attackers to steal secrets (database credentials, API keys, cloud access keys) through shell_tools.py execute_command function. The vulnerability leverages deceptive command approval where unexpanded $VAR references shown to human reviewers differ from executed commands containing expanded environment variable values. Requires user interaction. No public exploit identified at time of analysis.
Server-side request forgery in PraisonAIAgents multi-agent system allows authenticated attackers to force internal network reconnaissance and data exfiltration through unvalidated URL crawling. The web_crawl() function in versions prior to 1.5.128 accepts arbitrary URLs from AI agents without scheme allowlisting, hostname blocking, or private network checks, enabling access to cloud metadata endpoints (AWS/Azure/GCP), internal services, and local filesystems via file:// URIs. Exploitation requires low-privileged authenticated access with network reachability and no user interaction. No public exploit identified at time of analysis.
Command injection in PraisonAIAgents memory hooks executor allows authenticated local attackers to execute arbitrary shell commands through unsanitized user input passed to subprocess.run() with shell=True. Affects versions prior to 1.5.128. Two attack vectors exist: direct exploitation via hook configuration (pre_run_command/post_run_command) and automated exploitation through .praisonai/hooks.json lifecycle hooks (BEFORE_TOOL/AFTER_TOOL). Agent prompt injection enables persistent compromise by overwriting hooks.json, executing payloads silently at every lifecycle event without user interaction. No public exploit identified at time of analysis.
An attribute-read sandbox bypass in the PraisonAI multi-agent framework (pip package praisonaiagents before 1.6.59) lets prompt-influenced Python code reach blocklisted dunder attributes such as __class__, __bases__, __globals__ and __dict__, exposing in-process objects and secrets to the attacker. Exploitation requires the execute_code tool's sandbox mode with approval automatically granted (for example via PRAISONAI_AUTO_APPROVE or the YAML auto-approval path), after which two CPython semantics are chained: runtime string assembly evades the AST blocklist and str.format/str.format_map resolve dotted fields through C-level attribute access that never consults the Python-level _safe_getattr wrapper. The result is a high-confidentiality read primitive rather than a complete in-process execution chain; the vendor has published a fixed release (1.6.59) plus a public GitHub advisory containing a reproducer, and there is no CISA KEV listing indicating active exploitation.
Server-side request forgery in PraisonAI's SpiderTools web-scraping component (praisonaiagents before 1.6.59) lets an attacker-supplied public URL pass the initial validation check and then redirect to loopback, private, link-local, or cloud metadata addresses, with the internal response body returned through scrape_page and its extract_links, crawl, and extract_text callers. Exploitation requires the agent to fetch an attacker-influenced URL, and a local-only proof of vulnerability was published in the vendor's GHSA advisory; there is no public exploit tooling and no evidence of active exploitation (not in CISA KEV, EPSS 0.26% / 17th percentile). The issue is fixed in praisonaiagents 1.6.59 (PraisonAI 4.6.59).
Unauthorized filesystem mutation in praisonaiagents allows an LLM-controlled agent to rewrite arbitrary on-disk source files by invoking ast_grep_rewrite with dry_run=False, bypassing the @require_approval authorization gate uniformly enforced on every sibling mutation tool in the framework. All praisonaiagents releases prior to 1.6.58 are affected; the vulnerable function is registered as a top-level tool and exposed through the code_intelligence built-in profile. Exploitability is confirmed by a proof-of-concept in GHSA advisory GHSA-cfxv-8fw8-rwpv, and a secondary defect causes the function to return 'No changes made' to the caller even when files were modified, silently concealing the write.
PraisonAIAgents versions prior to 1.5.128 allow unauthenticated remote attackers to enumerate arbitrary files on the filesystem by exploiting unvalidated glob patterns in the list_files() tool. An attacker can use relative path traversal sequences (../) within the glob pattern parameter to bypass workspace directory boundary checks, revealing file metadata including existence, names, sizes, and timestamps for any path accessible to the application process. This information disclosure vulnerability has a CVSS score of 5.3 (low/medium impact) and no public exploit code has been identified.
PraisonAIAgents versions prior to 1.5.128 allow unauthenticated local attackers to read arbitrary files from the filesystem via the read_skill_file() function in skill_tools.py, which lacks the workspace boundary protections and approval requirements enforced by comparable file access functions. An agent subjected to prompt injection can exfiltrate sensitive files without user awareness or approval prompts, enabling confidentiality compromise with CVSS 6.2 (local attack vector, high confidentiality impact). No public exploit code or active exploitation has been reported at the time of analysis.
Unauthenticated remote agent enumeration and invocation in PraisonAI's AgentTeam.launch() / Agents.launch() HTTP server lets any client that can reach the listening port list deployed agents and trigger agent.chat() calls, burning model resources, reaching connected private context, and firing agent tools and workflow side effects. The affected artifact is the Python package praisonaiagents before 1.6.59, whose FastAPI server binds to 0.0.0.0 by default and accepts requests with no Authorization header - or even with an obviously wrong bearer token. Vendor-released patch: praisonaiagents 1.6.59 (PraisonAI v4.6.59); no public exploit identified at time of analysis, and the practical limiting factor is deployment: the routes are only remotely reachable if launch() is actually started and network-exposed rather than bound to localhost or placed behind an authenticating proxy.
Server-side request forgery in the SearxNG-backed search tools shipped with the praisonaiagents Python package before 1.6.62 lets prompt-injected content hijack the agent's outbound HTTP requests and read the responses back into the model's context, enabling internal service and API disclosure plus internal host/port enumeration. The vulnerable sink is the LLM-exposed searxng_url tool parameter, which is forwarded to requests.get() without any validation of scheme, host, port, or resolved address; search_web and searxng_search are part of the default agent tool profile, so any agent that ingests attacker-controlled web pages, files, or upstream tool output is in scope. The CVSS vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L (8.8) - no authentication is needed (PR:N), but exploitation depends on the agent actually processing malicious content and the model complying with the injected tool call (UI:R); confidential impact is high while integrity and availability impact are low. No public exploit identified at time of analysis; in cloud deployments the same primitive can reach the instance metadata endpoint (169.254.169.254) and potentially expose IAM credentials, though that requires the instance metadata service to be reachable from the agent's network position.
Unauthenticated MCP tool invocation in PraisonAI (praisonaiagents 0.6.0–1.6.58 and praisonai 3.10.0–4.6.58) lets a malicious website use DNS rebinding to reach a local or internal ToolsMCPServer SSE endpoint on /sse and /messages/, enumerate registered tools, and invoke them with the server user's privileges. The legacy SSE wrapper performs no Host, Origin, or authentication enforcement, while the newer Streamable HTTP transport rejects the same hostile Origin with HTTP 403, isolating the flaw to the legacy SSE path. An initial remediation ships in praisonaiagents
Unauthenticated tool invocation and potential remote code execution in PraisonAI Agents (praisonaiagents) before 1.6.59, where the MCP SSE transport started by ToolsMCPServer.run_sse() or launch_tools_mcp_server(transport='sse') binds to 0.0.0.0 and builds its Starlette application with no authentication middleware and no Origin validation. Any client that can reach the listening port (default 8080) can list and invoke every registered tool without credentials, and because the bundled SecurityConfig, origin-validation and DNS-rebinding checks in mcp/mcp_security.py are never called, a malicious web page can rebind a hostname to 127.0.0.1 and drive the same JSON-RPC calls against a developer's local instance; the practical impact scales with the registered toolset and becomes full RCE where file, shell, or code-execution tools are exposed. Exposure is gated on an operator actually launching the SSE transport - merely importing the library is not sufficient - and no public exploit code has been identified at time of analysis (EPSS 0.47%, SSVC exploitation: none), with a vendor patch available in 1.6.59.
IMAP command injection in the PraisonAI praisonaiagents email tools before 1.6.59 lets LLM-controlled arguments (from_addr, subject, query, message_id) break out of quoted IMAP SEARCH criteria and inject arbitrary IMAP commands, giving access to, modification of, or deletion of mailbox data. Exploitation requires an agent deployed with email credentials configured (EMAIL_ADDRESS and EMAIL_PASSWORD) and with the search_emails, reply_email, or archive_email tools exposed, plus an attacker able to steer the tool-call arguments — typically via crafted or indirect prompt injection reaching the agent. The advisory includes a static proof-of-concept data-flow trace, and CISA's SSVC assessment records exploitation status as 'poc'; the flaw is not listed in CISA KEV, and no EPSS score was supplied.
Unauthenticated remote code execution in the PraisonAI multi-agent framework lets any network-reachable caller run arbitrary operating-system commands on servers exposing the Jobs API. The attack chains two defects: the POST /api/v1/runs endpoint ships without the verify_token dependency used by the authenticated agent_invoke endpoint (PR:N, no credentials or session required), and an attacker-supplied top-level 'approve' field in the submitted agent_yaml is loaded into a ContextVar that the @require_approval decorator consults before any risk-level check, so listing 'execute_command' makes the critical-tool approval gate a no-op with no operator interaction (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-306). Affected releases are praisonai through 4.6.48 and praisonaiagents prior to 1.6.59, both fixed in 4.6.59 and 1.6.59 respectively; publicly available exploit code exists (a curl-based PoC is published in the GHSA advisory) and CISA's SSVC assessment rates the issue automatable with total technical impact, although no confirmed active exploitation (CISA KEV) has been reported and the current EPSS score is low at 0.41% (35th percentile).
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users route agent web-fetching functions to internal HTTP services by supplying hostnames - such as 127.0.0.1.nip.io - that pass the static IP blocklist in spider_tools._host_is_blocked() because the function never performs DNS resolution before validation. The affected functions scrape_page, extract_links, crawl, and extract_text are registered as default LLM-callable agent tools, so any agent prompted to retrieve a user-supplied URL will trigger this path; a live proof-of-concept is documented in the GitHub Security Advisory (GHSA-x44h-65qv-cw74), confirming that publicly available exploit code exists. The CVSS scope change (S:C) and high confidentiality impact (C:H) reflect real ability to exfiltrate responses from internal services such as cloud metadata endpoints or localhost-bound APIs.
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to unauthenticated remote callers, even when operators have explicitly configured an auth_token in ServerConfig. The AgentServer._create_app factory never reads or enforces the configured token, rendering it dead code while /info actively misleads operators by displaying it as masked ('***'), creating a false sense of security. No public exploit code has been identified at time of analysis, and it is not listed in CISA KEV; the fix is confirmed in praisonaiagents 1.6.58.
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe directory to execute arbitrary code as the PraisonAI process user. Affected are praisonai 3.9.26-4.6.57 and praisonaiagents 0.12.12-1.6.57. This is a hardening bypass: the vulnerable sink in Workflow._execute_include() skips the PRAISONAI_ALLOW_TEMPLATE_TOOLS/PRAISONAI_ALLOW_LOCAL_TOOLS opt-in gates and the centralized safe loader that protect all other tools.py autoload paths, making it a distinct variant within an established advisory family. No public exploit or CISA KEV listing has been identified at time of analysis.
Remote attackers can invoke arbitrary application callables in PraisonAI multi-agent systems by manipulating tool-call names to bypass tool declaration controls. Vulnerable versions (praisonai <4.6.37, praisonaiagents <1.6.37) resolve unmatched tool names against module globals and __main__ namespaces without permission validation when _perm_allow is None (default configuration). This enables unauthorized function execution beyond the intended tool list, allowing integrity compromise and potential information disclosure. Patched versions 4.6.37 and 1.6.37 address the tool name resolution vulnerability.
SQL injection in PraisonAI's multi-backend conversation storage system allows authenticated attackers to execute arbitrary SQL commands. The incomplete fix for CVE-2026-40315 validated input only in SQLiteConversationStore, leaving nine other database backends (MySQL, PostgreSQL, Turso, SingleStore, Supabase, SurrealDB, and their async variants) vulnerable to f-string SQL injection via unvalidated table_prefix and schema parameters. 52 injection points exist across the codebase. Exploitable in multi-tenant deployments or API-driven configurations where table_prefix is derived from external input. Patches released in praisonai 4.6.9 and praisonaiagents 1.6.9 address all affected backends. EPSS and KEV data unavailable; no public POC confirmed at time of analysis.
Unauthenticated remote session hijacking in PraisonAI's browser bridge (versions <4.5.139) and praisonaiagents (<1.5.140) allows network attackers to control browser automation sessions without authentication. The /ws WebSocket endpoint accepts connections from any client omitting the Origin header, enabling attackers to send start_session commands that hijack idle browser-extension sessions and receive all automation outputs. With CVSS 9.1 (Critical) scoring driven by network attack vector, low complexity, and no authentication requirement (AV:N/AC:L/PR:N), this represents a severe risk in any deployment where the default 0.0.0.0 binding exposes the service to untrusted networks. No public exploit identified at time of analysis, though exploitation requires only basic WebSocket client capabilities.
Arbitrary command and code execution in PraisonAI's workflow engine (versions <4.5.139) and praisonaiagents (<1.5.140) allows remote unauthenticated attackers to execute shell commands and Python code through malicious YAML workflow files. The vulnerability stems from unsafe processing of 'run:', 'script:', and 'python:' directives in job-type workflows without validation or sandboxing. With a critical CVSS score of 9.8 and network-accessible attack vector requiring no privileges or user interac
Arbitrary Python code execution in PraisonAI ≤4.5.138 occurs when malicious tools.py files are automatically imported from the current working directory without validation. Attackers placing a crafted tools.py in shared projects, cloned repositories, or writable workspaces achieve immediate code execution with full process privileges upon PraisonAI startup. EPSS data not available, but the local attack vector (AV:L) requiring no privileges (PR:N) or user interaction (UI:N) enables exploitation through supply chain and workspace poisoning attacks. No public exploit identified at time of analysis, though the vulnerability is trivial to exploit given the straightforward code injection mechanism.
Server-Side Request Forgery (SSRF) in PraisonAIAgents versions prior to 1.5.128 allows unauthenticated attackers to manipulate LLM agents into crawling arbitrary internal URLs. The httpx fallback crawler accepts user-supplied URLs without host validation and follows redirects, enabling access to cloud metadata endpoints (169.254.169.254), internal services, and localhost. Response content is returned to the agent and may be exposed in attacker-visible output. This vulnerability is the default behavior on fresh installations without Tavily API keys or Crawl4AI dependencies. No public exploit identified at time of analysis.
Environment variable exfiltration in PraisonAIAgents versions prior to 1.5.128 allows unauthenticated remote attackers to steal secrets (database credentials, API keys, cloud access keys) through shell_tools.py execute_command function. The vulnerability leverages deceptive command approval where unexpanded $VAR references shown to human reviewers differ from executed commands containing expanded environment variable values. Requires user interaction. No public exploit identified at time of analysis.
Server-side request forgery in PraisonAIAgents multi-agent system allows authenticated attackers to force internal network reconnaissance and data exfiltration through unvalidated URL crawling. The web_crawl() function in versions prior to 1.5.128 accepts arbitrary URLs from AI agents without scheme allowlisting, hostname blocking, or private network checks, enabling access to cloud metadata endpoints (AWS/Azure/GCP), internal services, and local filesystems via file:// URIs. Exploitation requires low-privileged authenticated access with network reachability and no user interaction. No public exploit identified at time of analysis.
Command injection in PraisonAIAgents memory hooks executor allows authenticated local attackers to execute arbitrary shell commands through unsanitized user input passed to subprocess.run() with shell=True. Affects versions prior to 1.5.128. Two attack vectors exist: direct exploitation via hook configuration (pre_run_command/post_run_command) and automated exploitation through .praisonai/hooks.json lifecycle hooks (BEFORE_TOOL/AFTER_TOOL). Agent prompt injection enables persistent compromise by overwriting hooks.json, executing payloads silently at every lifecycle event without user interaction. No public exploit identified at time of analysis.
An attribute-read sandbox bypass in the PraisonAI multi-agent framework (pip package praisonaiagents before 1.6.59) lets prompt-influenced Python code reach blocklisted dunder attributes such as __class__, __bases__, __globals__ and __dict__, exposing in-process objects and secrets to the attacker. Exploitation requires the execute_code tool's sandbox mode with approval automatically granted (for example via PRAISONAI_AUTO_APPROVE or the YAML auto-approval path), after which two CPython semantics are chained: runtime string assembly evades the AST blocklist and str.format/str.format_map resolve dotted fields through C-level attribute access that never consults the Python-level _safe_getattr wrapper. The result is a high-confidentiality read primitive rather than a complete in-process execution chain; the vendor has published a fixed release (1.6.59) plus a public GitHub advisory containing a reproducer, and there is no CISA KEV listing indicating active exploitation.
Server-side request forgery in PraisonAI's SpiderTools web-scraping component (praisonaiagents before 1.6.59) lets an attacker-supplied public URL pass the initial validation check and then redirect to loopback, private, link-local, or cloud metadata addresses, with the internal response body returned through scrape_page and its extract_links, crawl, and extract_text callers. Exploitation requires the agent to fetch an attacker-influenced URL, and a local-only proof of vulnerability was published in the vendor's GHSA advisory; there is no public exploit tooling and no evidence of active exploitation (not in CISA KEV, EPSS 0.26% / 17th percentile). The issue is fixed in praisonaiagents 1.6.59 (PraisonAI 4.6.59).
Unauthorized filesystem mutation in praisonaiagents allows an LLM-controlled agent to rewrite arbitrary on-disk source files by invoking ast_grep_rewrite with dry_run=False, bypassing the @require_approval authorization gate uniformly enforced on every sibling mutation tool in the framework. All praisonaiagents releases prior to 1.6.58 are affected; the vulnerable function is registered as a top-level tool and exposed through the code_intelligence built-in profile. Exploitability is confirmed by a proof-of-concept in GHSA advisory GHSA-cfxv-8fw8-rwpv, and a secondary defect causes the function to return 'No changes made' to the caller even when files were modified, silently concealing the write.
PraisonAIAgents versions prior to 1.5.128 allow unauthenticated remote attackers to enumerate arbitrary files on the filesystem by exploiting unvalidated glob patterns in the list_files() tool. An attacker can use relative path traversal sequences (../) within the glob pattern parameter to bypass workspace directory boundary checks, revealing file metadata including existence, names, sizes, and timestamps for any path accessible to the application process. This information disclosure vulnerability has a CVSS score of 5.3 (low/medium impact) and no public exploit code has been identified.
PraisonAIAgents versions prior to 1.5.128 allow unauthenticated local attackers to read arbitrary files from the filesystem via the read_skill_file() function in skill_tools.py, which lacks the workspace boundary protections and approval requirements enforced by comparable file access functions. An agent subjected to prompt injection can exfiltrate sensitive files without user awareness or approval prompts, enabling confidentiality compromise with CVSS 6.2 (local attack vector, high confidentiality impact). No public exploit code or active exploitation has been reported at the time of analysis.