praisonai vulnerabilities (PyPI)
107 vulnerabilities.
praisonaiPyPIPraisonAI Slack app_mention bypasses configured user/channel authorization8.3 HighpraisonaiPyPIPraisonAI recipe serve Typer command bypasses the non-localhost authentication guard8.2 HighpraisonaiPyPIPraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools8.3 HighpraisonaiPyPIPraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal7.5 HighpraisonaiPyPIPraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals8.8 HighpraisonaiPyPIPraisonAI has an Arbitrary File Write in Python API7.1 HighpraisonaiPyPIPraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution9.8 CriticalpraisonaiPyPIPraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate8.7 HighpraisonaiPyPIPraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)9.9 CriticalpraisonaiPyPIPraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context5.5 MediumpraisonaiPyPIPraisonAI `deploy --type api` emits a Flask server with authentication disabled by default9.8 CriticalpraisonaiPyPIPraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset9.8 CriticalpraisonaiPyPIPraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings5.5 MediumpraisonaiPyPIHome Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore9.3 CriticalpraisonaiPyPIPraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-443348.1 HighpraisonaiPyPIPraisonAI: Symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`8.7 HighpraisonaiPyPIPraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute8.6 HighpraisonaiPyPIPraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution7.3 HighpraisonaiPyPIPraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries6.3 MediumpraisonaiPyPIPraisonAI MCP `tools/call` path-traversal and RCE via Python `.pth` injection9.4 CriticalpraisonaiPyPIPraisonAI: Unauthenticated RCE via `tool_override.py`8.4 HighpraisonaiPyPIPraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)8.1 HighpraisonaiPyPIIncomplete fix for CVE-2026-34935: Command Injection in MervinPraison/PraisonAI9.8 CriticalpraisonaiPyPIPraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions9.1 CriticalpraisonaiPyPIPraisonAI: Critical RCE via `type: job` workflow YAML9.8 CriticalpraisonaiPyPIPraisonAI has RCE via Automatic tools.py Import8.4 HighpraisonaiPyPIPraisonAI: SQLiteConversationStore didn't validate table_prefix when constructing SQL queries7.2 HighpraisonaiPyPIPraisonAI - Arbitrary Shell Command Execution via Hardcoded Approval Mode Override8.7 HighpraisonaiPyPIPraisonAI Exposes Sensitive Environment Variable via Untrusted MCP Subprocess Execution5.5 MediumpraisonaiPyPIPraisonAI has Improper Control of Generation of Code ('Code Injection') and Protection Mechanism Failure in praisonai8.6 HighpraisonaiPyPIPraisonAI affected by arbitrary file write via path traversal in `praisonai recipe unpack`9.4 CriticalpraisonaiPyPIPraisonAI Affected by Implicit Execution of Arbitrary Code via Automatic `tools.py` Loading7.8 HighpraisonaiPyPIPraisonAI Affected by Untrusted Remote Template Code Execution9.3 CriticalpraisonaiPyPIPraisonAI Affected by Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOS5.3 MediumpraisonaiPyPIPraisonAI has an Unauthenticated Allow-List Manipulation Bypasses Agent Tool Approval Safety Controls7.9 HighpraisonaiPyPIPraisonAI Affected by Decompression Bomb DoS via Recipe Bundle Extraction Without Size Limits6.5 MediumpraisonaiPyPIPraisonAI's Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate Limits7.5 HighpraisonaiPyPIPraisonAI has an Unrestricted Upload Size in WSGI Recipe Registry Server Enables Memory Exhaustion DoS6.2 MediumpraisonaiPyPIPraisonAI has Server-Side Request Forgery via Unvalidated webhook_url in Jobs API7.2 HighpraisonaiPyPIPraisonAI has an Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars8.4 HighpraisonaiPyPIPraisonAI has Stored XSS via Unsanitized Agent Output in HTML Rendering (nh3 Not a Required Dependency)5.4 MediumpraisonaiPyPIImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai9.7 CriticalpraisonaiPyPIPraisonAI has a Template Injection in Agent Tool Definitions8.8 HighpraisonaiPyPIPraisonAI has Unauthenticated SSE Event Stream Exposes All Agent Activity in A2U Server7.5 HighpraisonaiPyPIPraisonAI Affected by Remote Code Execution via YAML Deserialization in Agent Definition Loading9.8 CriticalpraisonaiPyPIPraisonAI has a Path Traversal in FileTools9.2 CriticalpraisonaiPyPIPraisonAI recipe registry publish path traversal allows out-of-root file write7.1 HighpraisonaiPyPIPraisonAI recipe registry pull path traversal writes files outside the chosen output directory7.3 HighpraisonaiPyPIArbitrary File Write / Path Traversal in Action Orchestrator9.0 CriticalpraisonaiPyPIPraisonAI has an Arbitrary File Write (Zip Slip) in Templates Extraction8.1 High- Show moreLoading…