PraisonAI

PraisonAI: Shell command allowlist bypass via find -exec built-in action

PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls

PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface

PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend

PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF

PraisonAI: Prompt-injection defense blocks only when 3+ detector families fire simultaneously; realistic single-vector injections pass through unblocked

PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source

PraisonAI: Call API localhost-only authentication bypass via spoofed Host header

PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace

PraisonAI: Project custom command templates can read outside-workspace files into model prompts

PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL

PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats

PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation

PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents

PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing

PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)

PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server

PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret

PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete

PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced

PraisonAI vulnerable to Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation

PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114

PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated

PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks

PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced)

PraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local MCP server

PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication

PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation

PraisonAI Code agent tools fail open without a workspace boundary

PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai

PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)

PraisonAI: Jobs API exposes agent-execution endpoints with no authentication

praisonai: recipe serve auth middleware silently disables itself when no secret is set

PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass

PraisonAI: Unauthenticated Local File Inclusion via agent_file path in PraisonAI Jobs API

PraisonAI has an Arbitrary File Write in Python API

PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution

PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate

PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)

PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context

PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default

PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset

PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings

PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334

PraisonAI's symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`

PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute

PraisonAI MCP `tools/call` path-traversal => RCE via Python `.pth` injection

PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)

PraisonAI has an incomplete fix for CVE-2026-34935 - OS Command Injection

PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions

PraisonAI has critical RCE via `type: job` workflow YAML

PraisonAI Vulnerable to RCE via Automatic tools.py Import

PraisonAI: SQLiteConversationStore didn't validate table_prefix when constructing SQL queries

PraisonAI Vulnerable to Server-Side Request Forgery via Unvalidated webhook_url in Jobs API

PraisonAI Vulnerable to Sensitive Environment Variable Exposure via Untrusted MCP Subprocess Execution

PraisonAI Vulnerable to Implicit Execution of Arbitrary Code via Automatic `tools.py` Loading

PraisonAI Vulnerable to Decompression Bomb DoS via Recipe Bundle Extraction Without Size Limits

PraisonAI Vulnerable Untrusted Remote Template Code Execution

PraisonAI: Hardcoded `approval_mode="auto"` in Chainlit UI Overrides Administrator Configuration, Enabling Unapproved Shell Command Execution

PraisonAI Vulnerable to Code Injection and Protection Mechanism Failure

PraisonAI: Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOS

PraisonAI: Unauthenticated Allow-List Manipulation Bypasses Agent Tool Approval Safety Controls

PraisonAI has Unrestricted Upload Size in WSGI Recipe Registry Server that Enables Memory Exhaustion DoS

PraisonAI: Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate Limits

PraisonAI Vulnerable to Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars

PraisonAI Vulnerable to Stored XSS via Unsanitized Agent Output in HTML Rendering (nh3 Not a Required Dependency)

PraisonAI Vulnerable to OS Command Injection

PraisonAI has Template Injection in Agent Tool Definitions

PraisonAI Has Unauthenticated SSE Event Stream that Exposes All Agent Activity in A2U Server

PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading

PraisonAI recipe registry publish path traversal allows out-of-root file write

PraisonAI recipe registry pull path traversal writes files outside the chosen output directory

PraisonAI Vulnerable to Arbitrary File Write / Path Traversal in Action Orchestrator

PraisonAI Has Arbitrary File Write (Zip Slip) in Templates Extraction

PraisonAI Has Authentication Bypass via OAuthManager.validate_token()

PraisonAI Has Missing Authentication in WebSocket Gateway

PraisonAI Has Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandbox

PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback

PraisonAI Has ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools()

PraisonAI Has Second-Order SQL Injection in `get_all_user_threads`