praisonai vulnerabilities (PyPI)
107 vulnerabilities.
-
praisonaiPyPI Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92) 9.1 Critical -
praisonaiPyPI PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server 7.6 High -
praisonaiPyPI PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret 8.2 High -
praisonaiPyPI PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete 8.6 High -
praisonaiPyPI PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced 8.8 High -
praisonaiPyPI PraisonAI: Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation 6.8 Medium -
praisonaiPyPI PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114 7.1 High -
praisonaiPyPI PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated 7.3 High -
praisonaiPyPI PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks 7.1 High -
praisonaiPyPI PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution 8.6 High -
praisonaiPyPI PraisonAI: Unauthenticated unbounded session accumulation in the PraisonAI MCP HTTP server (memory exhaustion; session TTL never enforced) 6.5 Medium -
praisonaiPyPI PraisonAI: Origin validation bypass in MCP HTTP Stream transport allows browser-mediated unauthenticated tool execution on local MCP server 6.9 Medium -
praisonaiPyPI PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code 7.8 High -
praisonaiPyPI PraisonAI before 4.6.78 Remote Code Execution via Broken AST Sandbox 7.0 High -
praisonaiPyPI PraisonAI before 4.6.78 Missing Webhook Signature Verification 8.8 High -
praisonaiPyPI PraisonAI before 4.6.78 Authentication Bypass via Host Header Spoofing 8.8 High -
praisonaiPyPI PraisonAI before 4.6.78 Code Injection via API deployment generator 8.5 High -
praisonaiPyPI PraisonAI before 4.6.78 Authentication Bypass via HTTP-stream 6.9 Medium -
praisonaiPyPI PraisonAI before 4.6.78 Unenforced Security Policy in Subprocess Sandbox 8.7 High -
praisonaiPyPI PraisonAI before 4.6.78 Arbitrary File Write and Command Execution 9.4 Critical -
praisonaiPyPI PraisonAI before 4.6.78 Prompt Injection Defense Bypass 8.7 High -
praisonaiPyPI PraisonAI AgentMail before 4.6.78 Message Injection via Webhook 6.9 Medium -
praisonaiPyPI PraisonAI before 4.6.78 SQL/CQL Injection via vector dimension 9.3 Critical -
praisonaiPyPI PraisonAI before 4.6.78 Path Traversal via Custom Commands 6.8 Medium -
praisonaiPyPI PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation 9.1 Critical -
praisonaiPyPI PraisonAI before 4.6.78 Code Injection via f-string 9.4 Critical -
praisonaiPyPI PraisonAI before 4.6.78 Allowlist Bypass via find -exec 8.7 High -
praisonaiPyPI PraisonAI before 4.6.78 Path Traversal via ContextGatherer 6.8 Medium -
praisonaiPyPI PraisonAI before 4.6.78 Unauthenticated SSRF via webhook_url 6.9 Medium -
praisonaiPyPI PraisonAI before 4.6.78 Prompt Injection Defense Bypass 6.9 Medium -
praisonaiPyPI PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable 8.8 High -
praisonaiPyPI PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication 8.2 High -
praisonaiPyPI PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation 9.1 Critical -
praisonaiPyPI PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default 7.5 High -
praisonaiPyPI PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml 7.8 High -
praisonaiPyPI PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion 8.1 High -
praisonaiPyPI PraisonAI Code agent tools fail open without a workspace boundary 7.3 High -
praisonaiPyPI PraisonAI UI MCP connect endpoint allows unauthenticated local command execution 9.8 Critical -
praisonaiPyPI PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots) 8.6 High -
praisonaiPyPI PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation 9.8 Critical -
praisonaiPyPI PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding 7.2 High -
praisonaiPyPI praisonai: Jobs API exposes agent-execution endpoints with no authentication 9.8 Critical -
praisonaiPyPI praisonai: recipe serve auth middleware silently disables itself when no secret is set 9.8 Critical -
praisonaiPyPI PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass 9.8 Critical -
praisonaiPyPI PraisonAI: Unauthenticated Local File Inclusion via agent_file path in the Jobs API 7.5 High -
praisonaiPyPI PraisonAI: Compute-bridged file tools allow shell command injection 8.8 High -
praisonaiPyPI PraisonAI recipe.run_stream skips dangerous-tool policy enforcement 7.8 High -
praisonaiPyPI PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools 8.8 High -
praisonaiPyPI PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing 8.6 High -
praisonaiPyPI PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage 7.5 High - Show olderLoading…