tamilai (0.0.2) potentially affected by CVE-2026-57139 via praisonai (1.7.1)

praisonai NPM version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on praisonai and may be impacted: - tamilai 0.0.2 Source cves: CVE-2026-57139 Source advisory: MEND:CVE-2026-57139...

CVE-2026-57139 PraisonAI MCPServer exposes unauthenticated HTTP tools/call

PraisonAI is a multi-agent teams system. From 1.5.0 until 1.7.2, MCPServer.startHttp in src/praisonai-ts/src/mcp/server.ts binds without a host restriction and forwards every HTTP POST request to handleRequest without authentication or authorization. Any network client that can reach the port can...

CVE-2026-57139

The praisonai npm package (PraisonAI TypeScript multi-agent framework) is affected by an unauthenticated HTTP JSON-RPC vulnerability in MCPServer.startHttp(). The server binds to all interfaces (observed as :: IPv6) and forwards every POST to handleRequest() without credential checks, even though...

EUVD-2026-78393

PraisonAI is a multi-agent teams system. From 1.5.0 until 1.7.2, MCPServer.startHttp in src/praisonai-ts/src/mcp/server.ts binds without a host restriction and forwards every HTTP POST request to handleRequest without authentication or authorization. Any network client that can reach the port can...

CVE-2026-57133 PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, the shell helper exported from src/praisonai-ts/src/tools/utility-tools.ts checks only the first whitespace-delimited token against safeCommands and then passes the complete original string to childprocess.exec. A string that starts...

CVE-2026-57133 PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, the shell helper exported from src/praisonai-ts/src/tools/utility-tools.ts checks only the first whitespace-delimited token against safeCommands and then passes the complete original string to childprocess.exec. A string that starts...

EUVD-2026-78392

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, the shell helper exported from src/praisonai-ts/src/tools/utility-tools.ts checks only the first whitespace-delimited token against safeCommands and then passes the complete original string to childprocess.exec. A string that starts...

tamilai (0.0.2) potentially affected by CVE-2026-57133 via praisonai (1.7.1)

praisonai NPM version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on praisonai and may be impacted: - tamilai 0.0.2 Source cves: CVE-2026-57133 Source advisory: MEND:CVE-2026-57133...

CVE-2026-57133 PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, the shell helper exported from src/praisonai-ts/src/tools/utility-tools.ts checks only the first whitespace-delimited token against safeCommands and then passes the complete original string to childprocess.exec. A string that starts...

CVE-2026-57133

CVE-2026-57133 affects the PraisonAI npm package (praisonai) versions 1.5.1 through 1.7.1 . The shell() helper in utility-tools.ts validates only the first whitespace-delimited token against a read-only command allowlist, then passes the full string to child_process.exec(). Because exec() runs th...

CVE-2026-57135 PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients

PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, SandboxExecutor network-isolated mode in src/praisonai-ts/src/cli/features/sandbox-executor.ts uses buildEnv only to inject invalid httpproxy and httpsproxy environment variables and does not establish an operating-system network...

CVE-2026-57135

The npm package praisonai (PraisonAI multi-agent teams system, versions 1.2.3 through 1.7.1 ) contains a network-isolation protection failure in its SandboxExecutor network-isolated mode. The implementation in src/praisonai-ts/src/cli/features/sandbox-executor.ts relies solely on injecting proxy ...

tamilai (0.0.2) potentially affected by CVE-2026-57135 via praisonai (1.7.1)

praisonai NPM version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on praisonai and may be impacted: - tamilai 0.0.2 Source cves: CVE-2026-57135 Source advisory: MEND:CVE-2026-57135...

CVE-2026-57135 PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients

PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, SandboxExecutor network-isolated mode in src/praisonai-ts/src/cli/features/sandbox-executor.ts uses buildEnv only to inject invalid httpproxy and httpsproxy environment variables and does not establish an operating-system network...

EUVD-2026-78418

PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, SandboxExecutor network-isolated mode in src/praisonai-ts/src/cli/features/sandbox-executor.ts uses buildEnv only to inject invalid httpproxy and httpsproxy environment variables and does not establish an operating-system network...

CVE-2026-57135 PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients

PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, SandboxExecutor network-isolated mode in src/praisonai-ts/src/cli/features/sandbox-executor.ts uses buildEnv only to inject invalid httpproxy and httpsproxy environment variables and does not establish an operating-system network...

CVE-2026-57134 PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, MCPSecurity.evaluatePolicy in src/praisonai-ts/src/mcp/security.ts invokes the configured credential validator only when AuthMethod is api-key or bearer. Basic and OAuth policies accept any non-empty Authorization header without...

CVE-2026-57134

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, MCPSecurity.evaluatePolicy in src/praisonai-ts/src/mcp/security.ts invokes the configured credential validator only when AuthMethod is api-key or bearer. Basic and OAuth policies accept any non-empty Authorization header without...

CVE-2026-57134 PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, MCPSecurity.evaluatePolicy in src/praisonai-ts/src/mcp/security.ts invokes the configured credential validator only when AuthMethod is api-key or bearer. Basic and OAuth policies accept any non-empty Authorization header without...

CVE-2026-57134 PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, MCPSecurity.evaluatePolicy in src/praisonai-ts/src/mcp/security.ts invokes the configured credential validator only when AuthMethod is api-key or bearer. Basic and OAuth policies accept any non-empty Authorization header without...