Skip to contentMervinpraison Praisonai vulnerabilities
- mervinpraison praisonaiPraisonAI before 1.6.78 Path Traversal via config.tomlCVE-2026-60089Fix available6.9 Medium
- mervinpraison praisonaiPraisonAI before 4.6.78 Prompt Injection Defense BypassCVE-2026-60086Fix available6.9 Medium
- mervinpraison praisonaiPraisonAI - Information Disclosure via Shared MultiAgentLedger StateCVE-2026-560777.1 High
- mervinpraison praisonaiPraisonAI - Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI EndpointCVE-2026-560768.6 High
- mervinpraison praisonaiPraisonAI - Authorization Bypass via Unvalidated project_id in Issue Create/UpdateCVE-2026-58653Fix available5.3 Medium
- mervinpraison praisonai, praisonai-platform +1 morepraisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgeryCVE-2026-57147Fix available9.8 Critical
- mervinpraison praisonaiPraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailableCVE-2026-57144Fix available8.8 High
- mervinpraison praisonaiPraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authenticationCVE-2026-57132Fix available8.2 High
- mervinpraison praisonaiagentsPraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameterCVE-2026-57143Fix available8.8 High
- mervinpraison praisonai, praisonai-platform +1 morepraisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)CVE-2026-57148Fix available9.8 Critical
- mervinpraison praisonaiPraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path ValidationCVE-2026-57145Fix available9.1 Critical
- mervinpraison praisonaiPraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by defaultCVE-2026-57146Fix available7.5 High
- mervinpraison praisonaiPraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yamlCVE-2026-57142Fix available7.8 High
- mervinpraison praisonaiPraisonAI utility shell safe-command wrapper allowlist bypass via shell chainingCVE-2026-57133Fix available8.8 High
- mervinpraison praisonaiPraisonAI AgentLoop onToolCall approval runs after tool executionCVE-2026-57137Fix available8.8 High
- mervinpraison praisonaiPraisonAI MCPServer exposes unauthenticated HTTP tools/callCVE-2026-57139Fix available9.8 Critical
- mervinpraison praisonaiPraisonAI AgentOS exposes unauthenticated agent listing and invocationCVE-2026-57140Fix available9.4 Critical
- mervinpraison praisonaiPraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` ToolCVE-2026-57141Fix available9.8 Critical
- mervinpraison praisonaiPraisonAI SandboxExecutor allowedCommands bypass via shell chainingCVE-2026-57136Fix available8.8 High
- mervinpraison praisonaiPraisonAI codeMode sandbox escape via Function constructorCVE-2026-57138Fix available9.9 Critical
- mervinpraison praisonaiPraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clientsCVE-2026-57135Fix available7.6 High
- mervinpraison praisonaiPraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validationCVE-2026-57134Fix available8.2 High
- mervinpraison praisonaiagentsPraisonAI: IMAP Command Injection via Unsanitized Email Search ParametersCVE-2026-57130Fix available8.1 High
- mervinpraison praisonaiPraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletionCVE-2026-57113Fix available8.1 High
- mervinpraison praisonaiPraisonAI Code agent tools fail open without a workspace boundaryCVE-2026-56839Fix available7.3 High
- mervinpraison praisonaiPraisonAI UI MCP connect endpoint allows unauthenticated local command executionCVE-2026-57124Fix available9.8 Critical
- mervinpraison praisonaiPraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)CVE-2026-57122Fix available8.6 High
- mervinpraison praisonaiPraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform APICVE-2026-57121Fix available8.1 High
- mervinpraison praisonaiPraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocationCVE-2026-57116Fix available9.8 Critical
- mervinpraison praisonai, praisonaiagents +1 morePraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpointsCVE-2026-57118Fix available9.8 Critical
- mervinpraison praisonaiPraisonAI: Jobs webhook SSRF protection bypass via DNS rebindingCVE-2026-57114Fix available7.2 High
- mervinpraison praisonaipraisonai: Jobs API exposes agent-execution endpoints with no authenticationCVE-2026-57131Fix available9.8 Critical
- mervinpraison praisonaiagentsPraisonAI: Arbitrary File Read via `@file:` Mention Path TraversalCVE-2026-57129Fix available7.5 High
- mervinpraison praisonaipraisonai: recipe serve auth middleware silently disables itself when no secret is setCVE-2026-57127Fix available9.8 Critical
- mervinpraison praisonaipraisonaiagents: SSRF guard validates literal IPs only and never resolves DNSCVE-2026-57126Fix available8.5 High
- mervinpraison praisonai, praisonaiagents +1 morePraisonAI: Unauthenticated RCE via Jobs API + Approval BypassCVE-2026-57125Fix available9.8 Critical
- mervinpraison praisonaiPraisonAI: Unauthenticated Local File Inclusion via agent_file path in the Jobs APICVE-2026-57119Fix available7.5 High
- mervinpraison praisonaiagentsPraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired inCVE-2026-57123Fix available9.8 Critical
- mervinpraison praisonaiagentsPraisonAI: execute_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunderCVE-2026-57120Fix available6.5 Medium
- mervinpraison praisonai, praisonaiagents +1 morePraisonAI: SpiderTools redirect-target SSRF protection bypassCVE-2026-57115Fix available6.5 Medium
- mervinpraison praisonaiPraisonAI: Compute-bridged file tools allow shell command injectionCVE-2026-57117Fix available8.8 High
- mervinpraison praisonaiPraisonAI recipe.run_stream skips dangerous-tool policy enforcementCVE-2026-56838Fix available7.8 High
- mervinpraison praisonaiPraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous toolsCVE-2026-56840Fix available8.8 High
- mervinpraison praisonaiPraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missingCVE-2026-56837Fix available8.6 High
- mervinpraison praisonaiPraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storageCVE-2026-56834Fix available7.5 High
- mervinpraison praisonaiPraisonAI Slack app_mention bypasses configured user/channel authorizationCVE-2026-56835Fix available8.3 High
- mervinpraison praisonaiPraisonAI recipe serve Typer command bypasses the non-localhost authentication guardCVE-2026-56836Fix available8.2 High
- mervinpraison praisonai, praisonaiagents +1 morePraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered toolsCVE-2026-57112Fix available8.3 High
- mervinpraison praisonaiPraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversalCVE-2026-56833Fix available7.5 High
- mervinpraison praisonaiPraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvalsCVE-2026-56832Fix available8.8 High
- Show moreLoading…