Mervinpraison

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-55536	WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an attacker forge a Chrome-extension Origin header and drive connected browser extensions. The check uses re.match() against the unanchored pattern chrome-extension://[a-z0-9]{32}, so any Origin with 32+ trailing characters is accepted before websocket.accept(), after which start_session commands trigger arbitrary browser automation, cookie theft, and screenshot capture. This is a patch bypass of CVE-2026-40289 (GHSA-8x8f-54wf-vv92); a working PoC is published in the advisory, though it is not in CISA KEV - no public exploit weaponization beyond the advisory PoC is identified.	CRITICAL	9.1	0.3%	66	PoC
CVE-2026-55541	PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but never wired into the underlying FastAPI application, leaving POST /agents, POST /agents/{name}, and POST /api/v1/agents/{id}/invoke fully unauthenticated regardless of any key configured by the operator. All versions prior to 4.6.58 are affected, with the flaw present since approximately 4.6.34 when the serve subsystem first shipped. A public proof-of-concept exists per the GHSA advisory; no public exploit identified at time of analysis in CISA KEV, but the zero-authentication network attack surface makes this a high-priority fix for any deployment exposing the serve interface to untrusted networks.	HIGH	8.8	0.3%	64	PoC
CVE-2026-55534	Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller to execute configured agents via POST /agents and POST /agents/{agent_name} despite an operator-supplied --api-key. The FastAPI app created by _create_agents_app() accepts the key at the CLI layer but never applies it as middleware or a route dependency, rendering the documented authentication control entirely inert on those endpoints. A proof-of-concept is included in GHSA-7ww9-85pg-cv4x, and the flaw is fixed in v4.6.58 via an _authorise_request() method that enforces Bearer or X-Auth-Token header validation.	HIGH	8.6	0.3%	63	PoC
CVE-2026-55526	SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users route agent web-fetching functions to internal HTTP services by supplying hostnames - such as 127.0.0.1.nip.io - that pass the static IP blocklist in spider_tools._host_is_blocked() because the function never performs DNS resolution before validation. The affected functions scrape_page, extract_links, crawl, and extract_text are registered as default LLM-callable agent tools, so any agent prompted to retrieve a user-supplied URL will trigger this path; a live proof-of-concept is documented in the GitHub Security Advisory (GHSA-x44h-65qv-cw74), confirming that publicly available exploit code exists. The CVSS scope change (S:C) and high confidentiality impact (C:H) reflect real ability to exfiltrate responses from internal services such as cloud metadata endpoints or localhost-bound APIs.	HIGH	8.5	0.2%	63	PoC
CVE-2026-55533	Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe execution endpoints despite authentication being nominally enabled. Versions prior to 4.6.58 of the pip package are affected: when the server is started with --auth api-key or --auth jwt but the corresponding PRAISONAI_API_KEY or PRAISONAI_JWT_SECRET environment variable is absent, create_auth_middleware() silently bypasses all authentication checks. The CLI safety check that blocks external binding only verifies auth mode is not 'none', failing to detect this secret-absent misconfiguration, leaving POST /v1/recipes/run, /v1/recipes/stream, and /v1/recipes endpoints fully open to unauthenticated callers. No active exploitation is confirmed (not in CISA KEV); vendor-released patch is available in v4.6.58.	HIGH	8.2	0.3%	61	PoC
CVE-2026-55528	Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to unauthenticated remote callers, even when operators have explicitly configured an auth_token in ServerConfig. The AgentServer._create_app factory never reads or enforces the configured token, rendering it dead code while /info actively misleads operators by displaying it as masked ('***'), creating a false sense of security. No public exploit code has been identified at time of analysis, and it is not listed in CISA KEV; the fix is confirmed in praisonaiagents 1.6.58.	HIGH	8.2	0.3%	61	PoC
CVE-2026-55532	Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to execute arbitrary MCP tools on a developer's local machine when a victim visits a malicious webpage. The attack is enabled by a flawed prefix-match origin check (`startswith`) in versions prior to 4.6.58 that accepts `http://localhost.attacker.com` as a valid localhost origin, and is further facilitated by the absence of a default API key and the CORS simple-request mechanism (Content-Type: text/plain) that bypasses browser preflight. The highest-impact consequence is persistent prompt injection: a forged request can write attacker-controlled agent instruction files that the runtime loads on every subsequent agent run. No public exploit is identified at time of analysis; vendor-released patch 4.6.58 is confirmed.	HIGH	7.6	0.1%	58	PoC
CVE-2026-55527	Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any process-writable filesystem location by supplying a crafted user_id containing ../ sequences to the FileMemory constructor. All versions of the praisonaiagents pip package below 1.6.58 are affected; the vulnerability exists in the core library's FileMemory class, not an example or optional component. A detailed proof-of-concept is included in the GitHub Security Advisory (GHSA-gxmw-5f7x-6g22), and no public exploit identified at time of analysis beyond that PoC; no CISA KEV listing exists.	HIGH	7.1	0.3%	56	PoC
CVE-2026-55535	Server-Side Request Forgery in PraisonAI before version 4.6.58 allows unauthenticated remote attackers to force the application server to make HTTP requests to internal network resources, including cloud metadata endpoints (169.254.169.254), loopback services, and RFC 1918 hosts. Two independent bypass paths exist in the Jobs API webhook_url validator: a DNS rebinding path exploiting the TOCTOU gap between validation and request dispatch, and a fail-open condition where socket.gaierror exceptions are silently swallowed, accepting unresolvable domains with no validation at all. A detailed proof-of-concept including curl commands is published in the GHSA advisory; no CISA KEV listing was present at time of analysis.	MEDIUM	6.8	0.2%	54	PoC
CVE-2026-55531	Memory exhaustion in PraisonAI's MCP HTTP Stream server allows remote unauthenticated attackers to crash the service by flooding the initialize endpoint with requests. Each initialize call unconditionally appends a new dictionary to self._sessions with no eviction: the cleanup routine _cleanup_sessions is defined but has zero call sites in versions prior to 4.6.58, and the configured TTL is stored but never enforced. No public exploit is identified at time of analysis, but the attack requires only standard HTTP tooling against default deployments where no API key is configured.	MEDIUM	6.5	0.2%	53	PoC
CVE-2026-55530	Unauthorized filesystem mutation in praisonaiagents allows an LLM-controlled agent to rewrite arbitrary on-disk source files by invoking ast_grep_rewrite with dry_run=False, bypassing the @require_approval authorization gate uniformly enforced on every sibling mutation tool in the framework. All praisonaiagents releases prior to 1.6.58 are affected; the vulnerable function is registered as a top-level tool and exposed through the code_intelligence built-in profile. Exploitability is confirmed by a proof-of-concept in GHSA advisory GHSA-cfxv-8fw8-rwpv, and a secondary defect causes the function to return 'No changes made' to the caller even when files were modified, silently concealing the write.	MEDIUM	6.1	0.1%	51	PoC
CVE-2026-57138	PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, codeMode in src/praisonai-ts/src/tools/builtins/code-mode.ts executes untrusted JavaS	CRITICAL	9.9	0.7%	50
CVE-2026-57141	We need answer JSON only. Need synthesize. Need follow all fields. Need be careful. Let's analyze input. CVE-2026-57141 PraisonAI. Description: multi-agent systems. Prior to 1.7.2 codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts executes model-generated JavaScript with new Function() and with(sandbox), regex blocklist bypass via Function('return this')() recover global object and dynamically construct child_process module name. Attacker influence code argument can host process capabilities, read/write files, env credentials, OS commands with PraisonAI privileges. Fixed 1.7.2. CVSS 9.8 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-94. Reported by GitHub_M. CPE cpe:2.3:a:mervinpraison:praisonai:::::::: . Tags RCE, Code Injection, Praisonai. References: GHSA, commit, releases tag v4.6.60. Source evidence GHSA, vulnerable npm/praisonai <=1.7.1 fixed 1.7.2. Commit diff mentions praisonai>=4.6.60, python package version 1.6.60? Actually source evidence says Package npm/praisonai vulnerable <=1.7.1 fixed 1.7.2. Commit/release v4.6.60. There may be confusion between npm package version and GitHub release. Need mention maybe. The CVE says prior to 1.7.2, fixed 1.7.2. References release tag v4.6.60, Docker praisonai>=4.6.60. Commit shows Python agent version 1.6.60, TS package maybe 1.7.2. Need not overcomplicate but note. Need fields: product_name: "PraisonAI" maybe 1 word. Could be "PraisonAI". summary: original synthesis. Should mention remote code execution in PraisonAI prior to 1.7.2 due sandbox escape in codeMode tool. Affected: PraisonAI multi-agent systems where code-mode tool enabled. Attacker influencing code argument can achieve arbitrary code execution host. No KEV, no POC? Input has POC in GHSA, so public POC exists. EPSS not provided, so don't cite. CVSS 9.8. Need mention POC exists maybe. "Remote code execution in PraisonAI before 1.7.2 allows anyone who can influence the codeMode tool's code argument to escape the JavaScript	CRITICAL	9.8	0.8%	50
CVE-2026-57124	We need answer JSON only. Need synthesize. We need use all data. Need plain strings. Need be careful precision rules. Need include risk_assessment with "malbork" once lowercase. Need not mention elsewhere. Need evaluate. CVE: PraisonAI UI missing auth OS command injection. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE-78. Patch available fixed 4.6.59. CPE cpe:2.3:a:mervinpraison:praisonai::::::::. Tags: Command Injection, Praisonai, Mervinpraison. SSVC: Exploitation poc, Automatable yes, Technical impact total. EPSS? Not explicitly provided. KEV? Not provided, likely no. POC? SSVC exploitation poc says yes? Source says SSVC Exploitation: poc. Need use "publicly available exploit code exists" if POC yes but no KEV. KEV absent. Patch available. Need product_name: "PraisonAI" maybe 1-3 words. summary original synthesis. Start impact verb and product. E.g. "OS command execution in PraisonAI UI before 4.6.59 allows remote unauthenticated callers to execute arbitrary commands as the UI service account via the unauthenticated POST /api/mcp/connect endpoint, even if MCP handshake fails." Mention patch fixed. Public POC? We know SSVC poc. EPSS absent, no KEV. Need not mention EPSS if not. But maybe "no confirmed active exploitation" with KEV absence. Need use "publicly available exploit code exists" maybe from SSVC poc. summary says no active exploitation? Probably "No CISA KEV listing confirms active exploitation, but SSVC notes POC exists." technical_context: talk Python, AI multi-agent, Typer UI commands, aiui host app, Starlette? Endpoint passes command/args to StdioMCPClient local process. CWE-78 improper neutralization of special elements in OS command. CPE exact. Root cause no auth and command injection. Need educational. Mention default bind to 0.0.0.0. Mention fixed version. Mention commit changes? The commit diff includes security hardening for SSE security and path validation, but not directly auth? Actually fix 4.6.59 maybe released; commit adds web	CRITICAL	9.8	0.6%	50
CVE-2026-57139	We need answer JSON only. Need synthesize. We need adhere to all fields. Let's parse input. CVE-2026-57139 Description: PraisonAI multi-agent teams system. From 1.5.0 until 1.7.2, MCPServer.startHttp() in src/praisonai-ts/src/mcp/server.ts binds without host restriction and forwards every HTTP POST request to handleRequest() without authentication or authorization. Any network client that can reach the port can call tools/list, tools/call, resources/read, or prompts/get, causing registered handlers to run with server-side credentials and process privileges or disclose registered data. An initial remediation was released in version 1.7.2. CVSS Score: 9.8 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE: CWE-306 Reported by GitHub_M CPE: cpe:2.3:a:mervinpraison:praisonai:::::::: Tags: Authentication Bypass, Praisonai References: advisory GHSA, commit, release tag v4.6.60 Source evidence GHSA says package npm/praisonai vulnerable >=1.5.0 <=1.7.1 fixed 1.7.2. Also references release tag v4.6.60 maybe Python? Need note discrepancy? CVE description says initial remediation in 1.7.2. Fix version 1.7.2 for npm package. Release tag 4.6.60 is maybe different packaging. Need mention. Need product_name: "PraisonAI" likely 1 word but okay. They ask 1-3 words exact product. Could be "PraisonAI" maybe "PraisonAI MCPServer"? primary product. Use "PraisonAI". Summary: original synthesis, not copy. Start with impact verb and product. Need mention actively exploited? Input KEV absent? No KEV field. POC? no explicit POC. EPSS? not given. We can say no public exploit identified. But need not mention if missing? It asks if POC exists and EPSS risk if notable. We don't have EPSS. So "No public exploit identified at time of analysis; EPSS not provided." Need maybe avoid. "Unauthenticated remote code execution in PraisonAI's TypeScript MCPServer..." Wait CVE is missing auth leading to invoking tools, could cause RCE? CVSS C/I/A H but description says handlers run wit	CRITICAL	9.8	0.6%	50	PoC

CVE-2026-55536

WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an attacker forge a Chrome-extension Origin header and drive connected browser extensions. The check uses re.match() against the unanchored pattern chrome-extension://[a-z0-9]{32}, so any Origin with 32+ trailing characters is accepted before websocket.accept(), after which start_session commands trigger arbitrary browser automation, cookie theft, and screenshot capture. This is a patch bypass of CVE-2026-40289 (GHSA-8x8f-54wf-vv92); a working PoC is published in the advisory, though it is not in CISA KEV - no public exploit weaponization beyond the advisory PoC is identified.

CRITICAL

9.1

0.3%

66

PoC

CVE-2026-55541

PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but never wired into the underlying FastAPI application, leaving POST /agents, POST /agents/{name}, and POST /api/v1/agents/{id}/invoke fully unauthenticated regardless of any key configured by the operator. All versions prior to 4.6.58 are affected, with the flaw present since approximately 4.6.34 when the serve subsystem first shipped. A public proof-of-concept exists per the GHSA advisory; no public exploit identified at time of analysis in CISA KEV, but the zero-authentication network attack surface makes this a high-priority fix for any deployment exposing the serve interface to untrusted networks.

HIGH

8.8

0.3%

64

PoC

CVE-2026-55534

Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller to execute configured agents via POST /agents and POST /agents/{agent_name} despite an operator-supplied --api-key. The FastAPI app created by _create_agents_app() accepts the key at the CLI layer but never applies it as middleware or a route dependency, rendering the documented authentication control entirely inert on those endpoints. A proof-of-concept is included in GHSA-7ww9-85pg-cv4x, and the flaw is fixed in v4.6.58 via an _authorise_request() method that enforces Bearer or X-Auth-Token header validation.

HIGH

8.6

0.3%

63

PoC

CVE-2026-55526

SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users route agent web-fetching functions to internal HTTP services by supplying hostnames - such as 127.0.0.1.nip.io - that pass the static IP blocklist in spider_tools._host_is_blocked() because the function never performs DNS resolution before validation. The affected functions scrape_page, extract_links, crawl, and extract_text are registered as default LLM-callable agent tools, so any agent prompted to retrieve a user-supplied URL will trigger this path; a live proof-of-concept is documented in the GitHub Security Advisory (GHSA-x44h-65qv-cw74), confirming that publicly available exploit code exists. The CVSS scope change (S:C) and high confidentiality impact (C:H) reflect real ability to exfiltrate responses from internal services such as cloud metadata endpoints or localhost-bound APIs.

HIGH

8.5

0.2%

63

PoC

CVE-2026-55533

Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe execution endpoints despite authentication being nominally enabled. Versions prior to 4.6.58 of the pip package are affected: when the server is started with --auth api-key or --auth jwt but the corresponding PRAISONAI_API_KEY or PRAISONAI_JWT_SECRET environment variable is absent, create_auth_middleware() silently bypasses all authentication checks. The CLI safety check that blocks external binding only verifies auth mode is not 'none', failing to detect this secret-absent misconfiguration, leaving POST /v1/recipes/run, /v1/recipes/stream, and /v1/recipes endpoints fully open to unauthenticated callers. No active exploitation is confirmed (not in CISA KEV); vendor-released patch is available in v4.6.58.

HIGH

8.2

0.3%

61

PoC

CVE-2026-55528

Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to unauthenticated remote callers, even when operators have explicitly configured an auth_token in ServerConfig. The AgentServer._create_app factory never reads or enforces the configured token, rendering it dead code while /info actively misleads operators by displaying it as masked ('***'), creating a false sense of security. No public exploit code has been identified at time of analysis, and it is not listed in CISA KEV; the fix is confirmed in praisonaiagents 1.6.58.

HIGH

8.2

0.3%

61

PoC

CVE-2026-55532

Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to execute arbitrary MCP tools on a developer's local machine when a victim visits a malicious webpage. The attack is enabled by a flawed prefix-match origin check (`startswith`) in versions prior to 4.6.58 that accepts `http://localhost.attacker.com` as a valid localhost origin, and is further facilitated by the absence of a default API key and the CORS simple-request mechanism (Content-Type: text/plain) that bypasses browser preflight. The highest-impact consequence is persistent prompt injection: a forged request can write attacker-controlled agent instruction files that the runtime loads on every subsequent agent run. No public exploit is identified at time of analysis; vendor-released patch 4.6.58 is confirmed.

HIGH

7.6

0.1%

58

PoC

CVE-2026-55527

Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any process-writable filesystem location by supplying a crafted user_id containing ../ sequences to the FileMemory constructor. All versions of the praisonaiagents pip package below 1.6.58 are affected; the vulnerability exists in the core library's FileMemory class, not an example or optional component. A detailed proof-of-concept is included in the GitHub Security Advisory (GHSA-gxmw-5f7x-6g22), and no public exploit identified at time of analysis beyond that PoC; no CISA KEV listing exists.

HIGH

7.1

0.3%

56

PoC

CVE-2026-55535

Server-Side Request Forgery in PraisonAI before version 4.6.58 allows unauthenticated remote attackers to force the application server to make HTTP requests to internal network resources, including cloud metadata endpoints (169.254.169.254), loopback services, and RFC 1918 hosts. Two independent bypass paths exist in the Jobs API webhook_url validator: a DNS rebinding path exploiting the TOCTOU gap between validation and request dispatch, and a fail-open condition where socket.gaierror exceptions are silently swallowed, accepting unresolvable domains with no validation at all. A detailed proof-of-concept including curl commands is published in the GHSA advisory; no CISA KEV listing was present at time of analysis.

MEDIUM

6.8

0.2%

54

PoC

CVE-2026-55531

Memory exhaustion in PraisonAI's MCP HTTP Stream server allows remote unauthenticated attackers to crash the service by flooding the initialize endpoint with requests. Each initialize call unconditionally appends a new dictionary to self._sessions with no eviction: the cleanup routine _cleanup_sessions is defined but has zero call sites in versions prior to 4.6.58, and the configured TTL is stored but never enforced. No public exploit is identified at time of analysis, but the attack requires only standard HTTP tooling against default deployments where no API key is configured.

MEDIUM

6.5

0.2%

53

PoC

CVE-2026-55530

Unauthorized filesystem mutation in praisonaiagents allows an LLM-controlled agent to rewrite arbitrary on-disk source files by invoking ast_grep_rewrite with dry_run=False, bypassing the @require_approval authorization gate uniformly enforced on every sibling mutation tool in the framework. All praisonaiagents releases prior to 1.6.58 are affected; the vulnerable function is registered as a top-level tool and exposed through the code_intelligence built-in profile. Exploitability is confirmed by a proof-of-concept in GHSA advisory GHSA-cfxv-8fw8-rwpv, and a secondary defect causes the function to return 'No changes made' to the caller even when files were modified, silently concealing the write.

MEDIUM

6.1

0.1%

51

PoC

CVE-2026-57138

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, codeMode in src/praisonai-ts/src/tools/builtins/code-mode.ts executes untrusted JavaS

CRITICAL

9.9

0.7%

50

CVE-2026-57141

We need answer JSON only. Need synthesize. Need follow all fields. Need be careful. Let's analyze input. CVE-2026-57141 PraisonAI. Description: multi-agent systems. Prior to 1.7.2 codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts executes model-generated JavaScript with new Function() and with(sandbox), regex blocklist bypass via Function('return this')() recover global object and dynamically construct child_process module name. Attacker influence code argument can host process capabilities, read/write files, env credentials, OS commands with PraisonAI privileges. Fixed 1.7.2. CVSS 9.8 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-94. Reported by GitHub_M. CPE cpe:2.3:a:mervinpraison:praisonai:*:*:*:*:*:*:*:* . Tags RCE, Code Injection, Praisonai. References: GHSA, commit, releases tag v4.6.60. Source evidence GHSA, vulnerable npm/praisonai <=1.7.1 fixed 1.7.2. Commit diff mentions praisonai>=4.6.60, python package version 1.6.60? Actually source evidence says Package npm/praisonai vulnerable <=1.7.1 fixed 1.7.2. Commit/release v4.6.60. There may be confusion between npm package version and GitHub release. Need mention maybe. The CVE says prior to 1.7.2, fixed 1.7.2. References release tag v4.6.60, Docker praisonai>=4.6.60. Commit shows Python agent version 1.6.60, TS package maybe 1.7.2. Need not overcomplicate but note. Need fields: product_name: "PraisonAI" maybe 1 word. Could be "PraisonAI". summary: original synthesis. Should mention remote code execution in PraisonAI prior to 1.7.2 due sandbox escape in codeMode tool. Affected: PraisonAI multi-agent systems where code-mode tool enabled. Attacker influencing code argument can achieve arbitrary code execution host. No KEV, no POC? Input has POC in GHSA, so public POC exists. EPSS not provided, so don't cite. CVSS 9.8. Need mention POC exists maybe. "Remote code execution in PraisonAI before 1.7.2 allows anyone who can influence the codeMode tool's code argument to escape the JavaScript

CRITICAL

9.8

0.8%

50

CVE-2026-57124

We need answer JSON only. Need synthesize. We need use all data. Need plain strings. Need be careful precision rules. Need include risk_assessment with "malbork" once lowercase. Need not mention elsewhere. Need evaluate. CVE: PraisonAI UI missing auth OS command injection. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE-78. Patch available fixed 4.6.59. CPE cpe:2.3:a:mervinpraison:praisonai:*:*:*:*:*:*:*:*. Tags: Command Injection, Praisonai, Mervinpraison. SSVC: Exploitation poc, Automatable yes, Technical impact total. EPSS? Not explicitly provided. KEV? Not provided, likely no. POC? SSVC exploitation poc says yes? Source says SSVC Exploitation: poc. Need use "publicly available exploit code exists" if POC yes but no KEV. KEV absent. Patch available. Need product_name: "PraisonAI" maybe 1-3 words. summary original synthesis. Start impact verb and product. E.g. "OS command execution in PraisonAI UI before 4.6.59 allows remote unauthenticated callers to execute arbitrary commands as the UI service account via the unauthenticated POST /api/mcp/connect endpoint, even if MCP handshake fails." Mention patch fixed. Public POC? We know SSVC poc. EPSS absent, no KEV. Need not mention EPSS if not. But maybe "no confirmed active exploitation" with KEV absence. Need use "publicly available exploit code exists" maybe from SSVC poc. summary says no active exploitation? Probably "No CISA KEV listing confirms active exploitation, but SSVC notes POC exists." technical_context: talk Python, AI multi-agent, Typer UI commands, aiui host app, Starlette? Endpoint passes command/args to StdioMCPClient local process. CWE-78 improper neutralization of special elements in OS command. CPE exact. Root cause no auth and command injection. Need educational. Mention default bind to 0.0.0.0. Mention fixed version. Mention commit changes? The commit diff includes security hardening for SSE security and path validation, but not directly auth? Actually fix 4.6.59 maybe released; commit adds web

CRITICAL

9.8

0.6%

50

CVE-2026-57139

We need answer JSON only. Need synthesize. We need adhere to all fields. Let's parse input. CVE-2026-57139 Description: PraisonAI multi-agent teams system. From 1.5.0 until 1.7.2, MCPServer.startHttp() in src/praisonai-ts/src/mcp/server.ts binds without host restriction and forwards every HTTP POST request to handleRequest() without authentication or authorization. Any network client that can reach the port can call tools/list, tools/call, resources/read, or prompts/get, causing registered handlers to run with server-side credentials and process privileges or disclose registered data. An initial remediation was released in version 1.7.2. CVSS Score: 9.8 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE: CWE-306 Reported by GitHub_M CPE: cpe:2.3:a:mervinpraison:praisonai:*:*:*:*:*:*:*:* Tags: Authentication Bypass, Praisonai References: advisory GHSA, commit, release tag v4.6.60 Source evidence GHSA says package npm/praisonai vulnerable >=1.5.0 <=1.7.1 fixed 1.7.2. Also references release tag v4.6.60 maybe Python? Need note discrepancy? CVE description says initial remediation in 1.7.2. Fix version 1.7.2 for npm package. Release tag 4.6.60 is maybe different packaging. Need mention. Need product_name: "PraisonAI" likely 1 word but okay. They ask 1-3 words exact product. Could be "PraisonAI" maybe "PraisonAI MCPServer"? primary product. Use "PraisonAI". Summary: original synthesis, not copy. Start with impact verb and product. Need mention actively exploited? Input KEV absent? No KEV field. POC? no explicit POC. EPSS? not given. We can say no public exploit identified. But need not mention if missing? It asks if POC exists and EPSS risk if notable. We don't have EPSS. So "No public exploit identified at time of analysis; EPSS not provided." Need maybe avoid. "Unauthenticated remote code execution in PraisonAI's TypeScript MCPServer..." Wait CVE is missing auth leading to invoking tools, could cause RCE? CVSS C/I/A H but description says handlers run wit

CRITICAL

9.8

0.6%

50

PoC

Severity Breakdown

Monthly CVE Trend

Affected Products (5)

Top Risky CVEs