CVE-2026-90617

A vulnerability was detected in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This vulnerability affects the function runtask of the file interface/main.py of the component MCP HTTP Server. Performing a manipulation results in os command injection. The attack is possible ...

CVE-2026-90617 GH05TCREW PentestAgent MCP HTTP Server main.py run_task os command injection

A vulnerability was detected in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This vulnerability affects the function runtask of the file interface/main.py of the component MCP HTTP Server. Performing a manipulation results in os command injection. The attack is possible ...

CVE-2026-90617 GH05TCREW PentestAgent MCP HTTP Server main.py run_task os command injection

A vulnerability was detected in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This vulnerability affects the function runtask of the file interface/main.py of the component MCP HTTP Server. Performing a manipulation results in os command injection. The attack is possible ...

EUVD-2026-77176

A vulnerability was detected in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This vulnerability affects the function runtask of the file interface/main.py of the component MCP HTTP Server. Performing a manipulation results in os command injection. The attack is possible ...

CVE-2026-90617

GH05TCREW PentestAgent contains an os command injection in the MCP HTTP Server component, specifically in the run_task function of interface/main.py . The vulnerability is reachable remotely with no privileges required, allowing an attacker to manipulate input to execute arbitrary OS commands. Im...

CVE-2026-90617: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was detected in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This vulnerability affects the function runtask of the file interface/main.py of the component MCP HTTP Server. Performing a manipulation results in os command injection. The attack is possible ...

PT-2026-91031

Name of the Vulnerable Software and Affected Versions GH05TCREW PentestAgent versions up to cf882dabea3ed91cef016cdd115e5426315665a2 Description An OS command injection flaw exists in the MCP HTTP Server component within the run task function of the interface/main.py file. This issue allows a...

CVE-2026-81735

startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpServer bound the Streamable HTTP and SSE MCP transports to every interface, and its authentication middleware was optional: middlewares are...

EUVD-2026-67078

startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpServer bound the Streamable HTTP and SSE MCP transports to every interface, and its authentication middleware was optional: middlewares are...

CVE-2026-81735

UI-TARS-desktop (ByteDance) — the mcp-http-server package defaulted its listen address to :: when no host was supplied, binding Streamable HTTP and SSE MCP transports to every network interface. Authentication middleware was optional, and the @agent-infra/mcp-server-commands and @agent-infra/mcp-...

CVE-2026-81735: Missing Authentication for Critical Function

startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpServer bound the Streamable HTTP and SSE MCP transports to every interface, and its authentication middleware was optional: middlewares are...

PT-2026-82623

Name of the Vulnerable Software and Affected Versions UI-TARS-desktop mcp-http-server version 1.2.4 prior to commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168 Description The startServer.ts file in the mcp-http-server package defaults the listen address to :: when no host is provided. This causes t...

PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server

Summary The PraisonAI MCP server exposes an HTTP-stream transport praisonai mcp serve --transport http-stream that binds to localhost and, by default, has no API key. Its only access control for browser-originated requests is an Origin allowlist, which the code implements as required by the MCP...

GHSA-PVPH-5J39-V8QC PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server

Summary The PraisonAI MCP server exposes an HTTP-stream transport praisonai mcp serve --transport http-stream that binds to localhost and, by default, has no API key. Its only access control for browser-originated requests is an Origin allowlist, which the code implements as required by the MCP...

EUVD-2026-65544

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream validateorigin uses requestorigin.startswithallowed, allowing the attacker-controlled localhost.attacker.com HTTP origin to satisfy the localhost allowlist. A webpage can send Content-Type: text/plain requests...

CVE-2026-55532 PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream validateorigin uses requestorigin.startswithallowed, allowing the attacker-controlled localhost.attacker.com HTTP origin to satisfy the localhost allowlist. A webpage can send Content-Type: text/plain requests...

CVE-2026-55532 PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream validateorigin uses requestorigin.startswithallowed, allowing the attacker-controlled localhost.attacker.com HTTP origin to satisfy the localhost allowlist. A webpage can send Content-Type: text/plain requests...

CVE-2026-55532

PraisonAI is a multi-agent teams system. Prior to version 4.6.58 , the MCP HTTP Stream _validate_origin function uses request_origin.startswith(allowed), which allows an attacker-controlled origin such as localhost.attacker.com to satisfy a localhost allowlist entry. This enables an unauthenticat...

CVE-2026-55531 PraisonAI: Unauthenticated unbounded session accumulation in the PraisonAI MCP HTTP server (memory exhaustion; session TTL never enforced)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream mcppost handler creates a new sessions entry for every initialize request but does not call cleanupsessions or enforce a maximum. An unauthenticated caller can exhaust memory. The fix invokes cleanup and limit...

CVE-2026-55531 PraisonAI: Unauthenticated unbounded session accumulation in the PraisonAI MCP HTTP server (memory exhaustion; session TTL never enforced)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream mcppost handler creates a new sessions entry for every initialize request but does not call cleanupsessions or enforce a maximum. An unauthenticated caller can exhaust memory. The fix invokes cleanup and limit...