PraisonAI
by PraisonAI
Source repositories
CVEs (77)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-57126 | Hig | 0.48 | 8.5 | 0.00 | Sep 14, 2026 | PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, SpiderTools._validate_url calls _host_is_blocked, which checks literal host encodings but does not resolve DNS names before scrape_page, crawl, extract_links, extract_text, or URL-mention fetches connect.… | ||
| CVE-2026-57112 | Hig | 0.47 | 8.3 | 0.00 | Sep 15, 2026 | PraisonAI is a multi-agent teams system. From praisonaiagents 0.6.0 until 1.6.59 and PraisonAI 3.10.0 until 4.6.59, ToolsMCPServer.run_sse() in src/praisonai-agents/praisonaiagents/mcp/mcp_server.py mounts SseServerTransport on the legacy /sse and /messages/ endpoints without… | ||
| CVE-2026-47419 | Hig | 0.47 | 8.3 | 0.00 | Jul 21, 2026 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an* Insecure Direct Object Reference. The agent CRUD endpoints (`GET / PATCH / DELETE /workspaces/{workspace_id}/agents/{agent_id}`) gate access on… | ||
| CVE-2026-57132 | Hig | 0.46 | 8.2 | 0.00 | Sep 14, 2026 | PraisonAI is a multi-agent teams system. Prior to 4.6.62, setting PRAISONAI_CALL_AUTH to disabled makes verify_token accept requests to /api/v1/agents/{id}/invoke without CALL_SERVER_TOKEN authentication. Deployments that use the application's advertised opt-out can expose… | ||
| CVE-2026-57130 | Hig | 0.46 | 8.1 | 0.00 | Sep 14, 2026 | PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai-agents/praisonaiagents/tools/email_tools.py interpolates LLM-controlled from_addr, subject, and query values directly into quoted IMAP SEARCH criteria. Embedded quote, backslash, newline, or… | ||
| CVE-2026-55533 | Hig | 0.46 | 8.2 | 0.00 | Aug 25, 2026 | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, create_auth_middleware() allows requests when auth=api-key lacks PRAISONAI_API_KEY or JWT authentication lacks PRAISONAI_JWT_SECRET. An externally bound Recipe server can therefore accept unauthenticated POST… | ||
| CVE-2026-57143 | hig | 0.45 | — | — | Jun 18, 2026 | ### Summary A Server-Side Request Forgery (SSRF) vulnerability in the SearxNG / `search_web` search tools allows an attacker to make the server perform requests to arbitrary internal endpoints and read the responses back. The `searxng_url` argument is passed directly to… | ||
| CVE-2026-57113 | hig | 0.45 | — | — | Jun 18, 2026 | ## Summary PraisonAI's template loader accepts GitHub template URIs with refs, for example `github:owner/repo/[email protected]`. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into… | ||
| CVE-2026-56838 | hig | 0.45 | — | — | Jun 18, 2026 | # PraisonAI `recipe.run_stream()` skips dangerous-tool policy enforcement ## Summary PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explicitly passes `allow_dangerous_tools=True`. The normal `recipe.run()` path enforces this with… | ||
| CVE-2026-56840 | hig | 0.45 | — | — | Jun 18, 2026 | # HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools ## Summary `praisonai.bots.HTTPApproval` renders pending tool approval arguments directly into the approval dashboard HTML. An attacker-controlled tool argument… | ||
| CVE-2026-56837 | hig | 0.45 | — | — | Jun 18, 2026 | # PraisonAI LinearBot processes unsigned webhooks when `LINEAR_WEBHOOK_SECRET` is missing ## Summary PraisonAI's LinearBot starts a public webhook listener on `0.0.0.0` and treats `LINEAR_WEBHOOK_SECRET` as optional. When the secret is absent, startup only logs a warning and… | ||
| CVE-2026-56834 | hig | 0.45 | — | — | Jun 18, 2026 | # PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage ## Summary PraisonAI's Dynamic Context Discovery feature exposes artifact helper tools through `ctx.get_tools()`: ```python ctx = setup_dynamic_context() agent = Agent( … | ||
| CVE-2026-56835 | hig | 0.45 | — | — | Jun 18, 2026 | # PraisonAI Slack `app_mention` bypasses configured user/channel authorization ## Summary PraisonAI's Slack bot applies its configured `allowed_users`, `allowed_channels`, and unknown-user pairing policy in the normal Slack `message` event handler, but not in the adjacent… | ||
| CVE-2026-56836 | hig | 0.45 | — | — | Jun 18, 2026 | # PraisonAI `recipe serve` Typer command bypasses the non-localhost authentication guard ## Summary PraisonAI's installed console entrypoint is Typer-first. In current releases, the `recipe` command is registered in the Typer app and `praisonai recipe serve` dispatches to the… | ||
| CVE-2026-56833 | hig | 0.45 | — | — | Jun 18, 2026 | # PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal ## Summary PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The SDK reference describes the module as providing: -… | ||
| CVE-2026-56832 | hig | 0.45 | — | — | Jun 18, 2026 | # DiscordApproval accepts unrelated channel messages as dangerous-tool approvals ## Summary `praisonai.bots.DiscordApproval` approves a pending dangerous tool call when it sees any later non-bot message in the configured Discord channel whose text is classified as approval,… | ||
| CVE-2026-55522 | Hig | 0.44 | 7.8 | 0.00 | Aug 5, 2026 | PraisonAI is a multi-agent teams system. In versions 3.9.26 through 4.6.57 of praiseonai and 0.12.12 through 1.6.57 of praiseonaiagents, the workflow "include" feature is vulnerable to code execution. Workflow._execute_include() implicitly imports and runs an included recipe's… | ||
| CVE-2026-55523 | Hig | 0.43 | — | 0.00 | Aug 5, 2026 | PraisonAI is a multi-agent teams system. In versions 1.5.128 through 1.6.57, the praisonaiagents.tools.web_crawl_tools.web_crawl() function is vulnerable to server-side request forgery. While it validates the initially supplied URL and blocks direct loopback and private… | ||
| CVE-2026-57119 | Hig | 0.42 | 7.5 | 0.00 | Sep 14, 2026 | PraisonAI is a multi-agent teams system. Prior to 4.6.59, the unauthenticated Jobs API accepts an absolute or traversing agent_file path in POST /api/v1/runs and passes it to the job executor without a workspace allowlist or boundary check. A remote caller can cause the server… | ||
| CVE-2026-57129 | Hig | 0.42 | 7.5 | 0.00 | Sep 14, 2026 | PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, MentionsParser._process_file_mention accepts file-mention values and falls back from workspace-relative resolution to Path(file_path) without traversal, symlink, or workspace-boundary validation. Prompt… |
- risk 0.48cvss 8.5epss 0.00
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, SpiderTools._validate_url calls _host_is_blocked, which checks literal host encodings but does not resolve DNS names before scrape_page, crawl, extract_links, extract_text, or URL-mention fetches connect.…
- risk 0.47cvss 8.3epss 0.00
PraisonAI is a multi-agent teams system. From praisonaiagents 0.6.0 until 1.6.59 and PraisonAI 3.10.0 until 4.6.59, ToolsMCPServer.run_sse() in src/praisonai-agents/praisonaiagents/mcp/mcp_server.py mounts SseServerTransport on the legacy /sse and /messages/ endpoints without…
- risk 0.47cvss 8.3epss 0.00
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an* Insecure Direct Object Reference. The agent CRUD endpoints (`GET / PATCH / DELETE /workspaces/{workspace_id}/agents/{agent_id}`) gate access on…
- risk 0.46cvss 8.2epss 0.00
PraisonAI is a multi-agent teams system. Prior to 4.6.62, setting PRAISONAI_CALL_AUTH to disabled makes verify_token accept requests to /api/v1/agents/{id}/invoke without CALL_SERVER_TOKEN authentication. Deployments that use the application's advertised opt-out can expose…
- risk 0.46cvss 8.1epss 0.00
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai-agents/praisonaiagents/tools/email_tools.py interpolates LLM-controlled from_addr, subject, and query values directly into quoted IMAP SEARCH criteria. Embedded quote, backslash, newline, or…
- risk 0.46cvss 8.2epss 0.00
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, create_auth_middleware() allows requests when auth=api-key lacks PRAISONAI_API_KEY or JWT authentication lacks PRAISONAI_JWT_SECRET. An externally bound Recipe server can therefore accept unauthenticated POST…
- risk 0.45cvss —epss —
### Summary A Server-Side Request Forgery (SSRF) vulnerability in the SearxNG / `search_web` search tools allows an attacker to make the server perform requests to arbitrary internal endpoints and read the responses back. The `searxng_url` argument is passed directly to…
- risk 0.45cvss —epss —
## Summary PraisonAI's template loader accepts GitHub template URIs with refs, for example `github:owner/repo/[email protected]`. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into…
- risk 0.45cvss —epss —
# PraisonAI `recipe.run_stream()` skips dangerous-tool policy enforcement ## Summary PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explicitly passes `allow_dangerous_tools=True`. The normal `recipe.run()` path enforces this with…
- risk 0.45cvss —epss —
# HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools ## Summary `praisonai.bots.HTTPApproval` renders pending tool approval arguments directly into the approval dashboard HTML. An attacker-controlled tool argument…
- risk 0.45cvss —epss —
# PraisonAI LinearBot processes unsigned webhooks when `LINEAR_WEBHOOK_SECRET` is missing ## Summary PraisonAI's LinearBot starts a public webhook listener on `0.0.0.0` and treats `LINEAR_WEBHOOK_SECRET` as optional. When the secret is absent, startup only logs a warning and…
- risk 0.45cvss —epss —
# PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage ## Summary PraisonAI's Dynamic Context Discovery feature exposes artifact helper tools through `ctx.get_tools()`: ```python ctx = setup_dynamic_context() agent = Agent( …
- risk 0.45cvss —epss —
# PraisonAI Slack `app_mention` bypasses configured user/channel authorization ## Summary PraisonAI's Slack bot applies its configured `allowed_users`, `allowed_channels`, and unknown-user pairing policy in the normal Slack `message` event handler, but not in the adjacent…
- risk 0.45cvss —epss —
# PraisonAI `recipe serve` Typer command bypasses the non-localhost authentication guard ## Summary PraisonAI's installed console entrypoint is Typer-first. In current releases, the `recipe` command is registered in the Typer app and `praisonai recipe serve` dispatches to the…
- risk 0.45cvss —epss —
# PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal ## Summary PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The SDK reference describes the module as providing: -…
- risk 0.45cvss —epss —
# DiscordApproval accepts unrelated channel messages as dangerous-tool approvals ## Summary `praisonai.bots.DiscordApproval` approves a pending dangerous tool call when it sees any later non-bot message in the configured Discord channel whose text is classified as approval,…
- risk 0.44cvss 7.8epss 0.00
PraisonAI is a multi-agent teams system. In versions 3.9.26 through 4.6.57 of praiseonai and 0.12.12 through 1.6.57 of praiseonaiagents, the workflow "include" feature is vulnerable to code execution. Workflow._execute_include() implicitly imports and runs an included recipe's…
- risk 0.43cvss —epss 0.00
PraisonAI is a multi-agent teams system. In versions 1.5.128 through 1.6.57, the praisonaiagents.tools.web_crawl_tools.web_crawl() function is vulnerable to server-side request forgery. While it validates the initially supplied URL and blocks direct loopback and private…
- risk 0.42cvss 7.5epss 0.00
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the unauthenticated Jobs API accepts an absolute or traversing agent_file path in POST /api/v1/runs and passes it to the job executor without a workspace allowlist or boundary check. A remote caller can cause the server…
- risk 0.42cvss 7.5epss 0.00
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, MentionsParser._process_file_mention accepts file-mention values and falls back from workspace-relative resolution to Path(file_path) without traversal, symlink, or workspace-boundary validation. Prompt…
Page 2 of 4