praisonaiagents vulnerabilities (PyPI)
50 vulnerabilities.
-
praisonaiagentsPyPI PraisonAI: Arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location 7.1 High -
praisonaiagentsPyPI PraisonAI: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool 6.1 Medium -
praisonaiagentsPyPI PraisonAI: SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`) 8.5 High -
praisonaiagentsPyPI praisonaiagents: AgentServer declares auth_token but never enforces it on any route (CWE-862) 8.2 High -
praisonaiagentsPyPI PraisonAI: SSRF via redirect-following in praisonaiagents web_crawl 7.5 High -
praisonaiagentsPyPI PraisonAI: SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap) 7.5 High -
praisonaiagentsPyPI PraisonAI has a`web_crawl` SSRF protection bypass via unchecked redirect targets 7.7 High -
praisonaiagentsPyPI PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code 7.8 High -
praisonaiagentsPyPI PraisonAI before 1.6.78 Remote Code Execution via Plugin Auto-Discovery 8.6 High -
praisonaiagentsPyPI PraisonAI before 1.6.78 Remote Code Execution via SkillTools 8.6 High -
praisonaiagentsPyPI PraisonAI before 1.6.78 DNS Rebinding SSRF via web_crawl 8.4 High -
praisonaiagentsPyPI PraisonAI before 1.6.78 Tool Approval Cache Bypass 6.9 Medium -
praisonaiagentsPyPI PraisonAI before 1.6.78 Remote Code Execution via CodeAgent 10.0 Critical -
praisonaiagentsPyPI PraisonAI before 1.6.78 SSRF via Crawl4AI Chromium backend 8.4 High -
praisonaiagentsPyPI PraisonAI before 1.6.78 Remote Code Execution via tools.py 8.5 High -
praisonaiagentsPyPI PraisonAI FastContext before 1.6.78 Path Traversal 6.9 Medium -
praisonaiagentsPyPI PraisonAI before 1.6.78 Path Traversal via config.toml 6.9 Medium -
praisonaiagentsPyPI PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter 8.8 High -
praisonaiagentsPyPI PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters 8.1 High -
praisonaiagentsPyPI PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints 9.8 Critical -
praisonaiagentsPyPI PraisonAI: Arbitrary File Read via `@file:` Mention Path Traversal 7.5 High -
praisonaiagentsPyPI praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS 8.5 High -
praisonaiagentsPyPI PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass 9.8 Critical -
praisonaiagentsPyPI PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in 9.8 Critical -
praisonaiagentsPyPI PraisonAI: execute_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunder 6.5 Medium -
praisonaiagentsPyPI PraisonAI: SpiderTools redirect-target SSRF protection bypass 6.5 Medium -
praisonaiagentsPyPI PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools 8.3 High -
praisonaiagentsPyPI PraisonAI: Unauthenticated Event Injection via SSE `/publish` Endpoint 4.3 Medium -
praisonaiagentsPyPI PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode) 9.9 Critical -
praisonaiagentsPyPI PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context 5.5 Medium -
praisonaiagentsPyPI PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings 5.5 Medium -
praisonaiagentsPyPI PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute 8.6 High -
praisonaiagentsPyPI SSRF bypass in PraisonAI 7.7 High -
praisonaiagentsPyPI PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315) 8.1 High -
praisonaiagentsPyPI PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions 9.1 Critical -
praisonaiagentsPyPI PraisonAI: Critical RCE via `type: job` workflow YAML 9.8 Critical -
praisonaiagentsPyPI PraisonAI has RCE via Automatic tools.py Import 8.4 High -
praisonaiagentsPyPI PraisonAI - Tool Approval Cache Bypass via Coarse-Grained Caching 6.8 Medium -
praisonaiagentsPyPI PraisonAI: Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI Endpoint 8.1 High -
praisonaiagentsPyPI PraisonAIAgents has SSRF via unvalidated URL in `web_crawl` httpx fallback 7.1 High -
praisonaiagentsPyPI PraisonAIAgents Affected by Environment Variable Secret Exfiltration via os.path.expandvars() Bypassing shell=False in Shell Tool 7.4 High -
praisonaiagentsPyPI PraisonAIAgents has a Path Traversal via Unvalidated Glob Pattern in list_files Bypasses Workspace Boundary 5.3 Medium -
praisonaiagentsPyPI PraisonAIAgents has SSRF and Local File Read via Unvalidated URLs in web_crawl Tool 7.7 High -
praisonaiagentsPyPI PraisonAIAgents Affected by Arbitrary File Read via read_skill_file Missing Workspace Boundary and Approval Gate 6.2 Medium -
praisonaiagentsPyPI PraisonAIAgents has an OS Command Injection via shell=True in Memory Hooks Executor (memory/hooks.py) 9.3 Critical -
praisonaiagentsPyPI PraisonAI - Arbitrary File Read and Write via Path Traversal in MultiAgentMonitor 8.7 High -
praisonaiagentsPyPI PraisonAIAgents has a sandbox escape via exception frame traversal in `execute_code` (subprocess mode) 10.0 Critical -
praisonaiagentsPyPI PraisonAI: SSRF in FileTools.download_file() via Unvalidated URL 8.6 High -
praisonaiagentsPyPI PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution 7.8 High -
praisonaiagentsPyPI PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code 10.0 Critical