827 matches found
CVE-2026-47393 PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default
PraisonAI is a multi-agent teams system. CVE-2026-44338 GHSA-6rmh-7xcm-cpxj documents that PraisonAI ships a code-generator praisonai.deploy.api.generateapiservercode that emits a Flask API server with authentication disabled by default. Users who follow the documented quickstart praisonai deploy...
CVE-2026-47393
PraisonAI's code generator for API servers (praisonai.deploy.api.generate_api_server_code) emits a Flask API server with authentication disabled by default. Default config sets auth_enabled=False and auth_token=None, causing check_auth() to short-circuit and accept unauthenticated requests to /ch...
CVE-2026-47393 PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default
PraisonAI is a multi-agent teams system. CVE-2026-44338 GHSA-6rmh-7xcm-cpxj documents that PraisonAI ships a code-generator praisonai.deploy.api.generateapiservercode that emits a Flask API server with authentication disabled by default. Users who follow the documented quickstart praisonai deploy...
CVE-2026-47392 PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)
PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, executecode in praisonaiagents/tools/pythontools.py v1.6.37, subprocess sandbox mode can be fully bypassed using print.self to retrieve the real Python builtins modul...
CVE-2026-47392 PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)
PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, executecode in praisonaiagents/tools/pythontools.py v1.6.37, subprocess sandbox mode can be fully bypassed using print.self to retrieve the real Python builtins modul...
CVE-2026-47392
CVE-2026-47392 describes a sandbox escape in PraisonAI/praisonaiagents where evaluating code via execute_code() in subprocess sandbox mode can be bypassed by accessing the real builtins module through print.self , then retrieving import via vars() and constructing a dynamic attribute access to im...
CVE-2026-47390 PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings
PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, spidertools URL validation can be bypassed using alternate loopback host encodings. The tool contains a URL validation function intended to block local or unsafe...
EUVD-2026-46278
PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, spidertools URL validation can be bypassed using alternate loopback host encodings. The tool contains a URL validation function intended to block local or unsafe...
CVE-2026-47390
Summary: CVE-2026-47390 describes an SSRF protection bypass in PraisonAI’s spider_tools where the URL host validation only blocks exact literal hosts like localhost/127.0.0.1 and fails to resolve DNS or handle non-dotted loopback encodings. This allows attacker-controlled URLs with alternate loop...
CVE-2026-47390 PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings
PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, spidertools URL validation can be bypassed using alternate loopback host encodings. The tool contains a URL validation function intended to block local or unsafe...
CVE-2026-56840
creationtimestamp| type| source ---|---|--- 2026-07-20 22:37:58+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-63v4-w882-g4x2...
CVE-2026-56832
creationtimestamp| type| source ---|---|--- 2026-07-20 22:37:19+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8579-rgg5-ph2m...
CVE-2026-56834
creationtimestamp| type| source ---|---|--- 2026-07-20 22:37:15+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-j7qx-p75m-wp7g...
CVE-2026-56837
creationtimestamp| type| source ---|---|--- 2026-07-20 22:37:06+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-fc26-m9pf-v56q...
CVE-2026-56839
creationtimestamp| type| source ---|---|--- 2026-07-20 22:37:02+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-gcq3-mfvh-3x25...
CVE-2026-57112
creationtimestamp| type| source ---|---|--- 2026-07-20 22:36:59+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vmf9-xx9w-86wx...
CVE-2026-57115
creationtimestamp| type| source ---|---|--- 2026-07-20 22:36:57+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6h9p-93hq-q7h6...
CVE-2026-57114
creationtimestamp| type| source ---|---|--- 2026-07-20 22:36:41+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rjvw-7vvw-549v...
CVE-2026-57124
creationtimestamp| type| source ---|---|--- 2026-07-20 22:36:31+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-p75f-6fp4-p57w 2026-07-23 17:02:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrdcvkwlge2r...