MCP server CVEs

PraisonAI: Shell command allowlist bypass via find -exec built-in action

PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls

PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface

PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend

PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF

PraisonAI: Prompt-injection defense blocks only when 3+ detector families fire simultaneously; realistic single-vector injections pass through unblocked

PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source

PraisonAI: Call API localhost-only authentication bypass via spoofed Host header

PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace

PraisonAI: Project custom command templates can read outside-workspace files into model prompts

PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL

PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats

PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation

PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents

PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing

PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)

PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server

PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret

PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete

PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced

PraisonAI vulnerable to Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation

PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114

PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated

PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks

PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution

PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced)

PraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local MCP server

PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code

MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`

ouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys

PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable

PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication

PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation

PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default

PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml

PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion

PraisonAI Code agent tools fail open without a workspace boundary

PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai

PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)

PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation

PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding

PraisonAI: Jobs API exposes agent-execution endpoints with no authentication

praisonai: recipe serve auth middleware silently disables itself when no secret is set

PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass

PraisonAI: Unauthenticated Local File Inclusion via agent_file path in PraisonAI Jobs API

PraisonAI: Compute-bridged file tools allow shell command injection

PraisonAI recipe.run_stream skips dangerous-tool policy enforcement

PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools

PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing

PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage

PraisonAI Slack app_mention bypasses configured user/channel authorization

PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard

PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools

PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal

PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals

MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper

PraisonAI has an Arbitrary File Write in Python API

PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution

PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate

PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)

PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context

PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default

PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset

PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings

PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334

ouroboros-ai Vulnerable to Remote Code Execution via Untrusted Project-Directory .env

Windows-MCP: HTTP transports expose unauthenticated PowerShell control with wildcard CORS

PraisonAI's symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`

PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute

PraisonAI MCP `tools/call` path-traversal => RCE via Python `.pth` injection

PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries

PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution

PraisonAI has unauthenticated RCE via `tool_override.py` (CVE-2026-40287 patch bypass)

PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)

PraisonAI has an incomplete fix for CVE-2026-34935 - OS Command Injection

excel-mcp-server has a Path Traversal issue

PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions

PraisonAI has critical RCE via `type: job` workflow YAML

PraisonAI Vulnerable to RCE via Automatic tools.py Import

PraisonAI: SQLiteConversationStore didn't validate table_prefix when constructing SQL queries

PraisonAI Vulnerable to Server-Side Request Forgery via Unvalidated webhook_url in Jobs API

PraisonAI Vulnerable to Sensitive Environment Variable Exposure via Untrusted MCP Subprocess Execution

PraisonAI vulnerable to arbitrary file write via path traversal in `praisonai recipe unpack`

PraisonAI Vulnerable to Implicit Execution of Arbitrary Code via Automatic `tools.py` Loading

PraisonAI Vulnerable to Decompression Bomb DoS via Recipe Bundle Extraction Without Size Limits

PraisonAI Vulnerable Untrusted Remote Template Code Execution

PraisonAI: Hardcoded `approval_mode="auto"` in Chainlit UI Overrides Administrator Configuration, Enabling Unapproved Shell Command Execution

PraisonAI Vulnerable to Code Injection and Protection Mechanism Failure

PraisonAI: Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOS

PraisonAI: Unauthenticated Allow-List Manipulation Bypasses Agent Tool Approval Safety Controls

PraisonAI has Unrestricted Upload Size in WSGI Recipe Registry Server that Enables Memory Exhaustion DoS

PraisonAI: Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate Limits

PraisonAI Vulnerable to Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars

PraisonAI Vulnerable to Stored XSS via Unsanitized Agent Output in HTML Rendering (nh3 Not a Required Dependency)

PraisonAI Vulnerable to OS Command Injection

PraisonAI has Template Injection in Agent Tool Definitions

PraisonAI Has Unauthenticated SSE Event Stream that Exposes All Agent Activity in A2U Server

PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading

stata-mcp has insufficient validation of user-supplied Stata do-file content that can lead to command execution

PraisonAI Has Path Traversal in FileTools

PraisonAI recipe registry publish path traversal allows out-of-root file write

PraisonAI recipe registry pull path traversal writes files outside the chosen output directory

PraisonAI Vulnerable to Arbitrary File Write / Path Traversal in Action Orchestrator

PraisonAI Has Arbitrary File Write (Zip Slip) in Templates Extraction

PraisonAI Has Authentication Bypass via OAuthManager.validate_token()

PraisonAI Has Missing Authentication in WebSocket Gateway

PraisonAI Has Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandbox

PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback

PraisonAI Has ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools()

PraisonAI Has Second-Order SQL Injection in `get_all_user_threads`

PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()

Browser Use allows bypassing `allowed_domains` by putting a decoy domain in http auth username portion of a URL