1771 matches found
GHSA-4W49-GWV8-FPJG PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF
Summary PraisonAI's Async Jobs API enables its API-key middleware only when PRAISONAIJOBSAPIKEY is set, so by default every endpoint is unauthenticated. An unauthenticated POST /api/v1/runs accepts an attacker-controlled webhookurl; on job completion the server POSTs the job payload to it via...
PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF
Summary PraisonAI's Async Jobs API enables its API-key middleware only when PRAISONAIJOBSAPIKEY is set, so by default every endpoint is unauthenticated. An unauthenticated POST /api/v1/runs accepts an attacker-controlled webhookurl; on job completion the server POSTs the job payload to it via...
EUVD-2026-42896
PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF...
GHSA-4R3P-W3MC-5V34 PraisonAI: Prompt-injection defense blocks only when 3+ detector families fire simultaneously; realistic single-vector injections pass through unblocked
Summary PraisonAI's opt-in prompt-injection defense enableinjectiondefense only blocks at ThreatLevel.CRITICAL, which requires three or more distinct detector families to match simultaneously. A realistic single- or double-vector prompt injection e.g. "Ignore all previous instructions…" is...
PraisonAI: Prompt-injection defense blocks only when 3+ detector families fire simultaneously; realistic single-vector injections pass through unblocked
Summary PraisonAI's opt-in prompt-injection defense enableinjectiondefense only blocks at ThreatLevel.CRITICAL, which requires three or more distinct detector families to match simultaneously. A realistic single- or double-vector prompt injection e.g. "Ignore all previous instructions…" is...
GHSA-79FV-7HQ9-W7XG PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source
API deploy code generator embeds unescaped YAML fields into Python source Summary PraisonAI's API deployment generator copies deploy.api.host from agents.yaml directly into generated Python source without safe literal encoding. A malicious PraisonAI project can set that host value to a Python...
PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source
API deploy code generator embeds unescaped YAML fields into Python source Summary PraisonAI's API deployment generator copies deploy.api.host from agents.yaml directly into generated Python source without safe literal encoding. A malicious PraisonAI project can set that host value to a Python...
PraisonAI: Call API localhost-only authentication bypass via spoofed Host header
Call API localhost-only authentication bypass via spoofed Host header Summary PraisonAI's patched PRAISONAICALLAUTH=disabled safeguard for the n8n/call agent invocation API can be bypassed with a spoofed Host: 127.0.0.1 header, allowing an unauthenticated network caller to list and invoke...
GHSA-2GPF-2492-Q9JH PraisonAI: Call API localhost-only authentication bypass via spoofed Host header
Call API localhost-only authentication bypass via spoofed Host header Summary PraisonAI's patched PRAISONAICALLAUTH=disabled safeguard for the n8n/call agent invocation API can be bypassed with a spoofed Host: 127.0.0.1 header, allowing an unauthenticated network caller to list and invoke...
EUVD-2026-44641
PraisonAI: Call API localhost-only authentication bypass via spoofed Host header...
GHSA-Q7M5-3JMV-VM48 PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace
ContextGatherer include resolution permits absolute and traversal reads outside the workspace Summary PraisonAI's praisonai.ui.context.ContextGatherer treats the configured directory as the project workspace, but project-controlled .praisoncontext and .praisoninclude files can name absolute paths...
EUVD-2026-42897
PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace...
EUVD-2026-43174
PraisonAI: Project custom command templates can read outside-workspace files into model prompts...
GHSA-XPX6-X8C2-MW5W PraisonAI: Project custom command templates can read outside-workspace files into model prompts
Project custom command templates can read outside-workspace files into model prompts Summary PraisonAI's new file-based custom command feature auto-discovers project commands from .praisonai/commands/.md. When a user runs praisonai run --command inside a repository, the command body is interpolat...
GHSA-WF65-4JJX-Q444 PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL
PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL Summary The PGVector and Cassandra knowledge-store backends validate SQL/CQL identifiers such as schema, keyspace, and collection names, but still insert the caller-controlled dimension argument directly into CREATE...
EUVD-2026-43175
PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL...
EUVD-2026-44645
PraisonAI: SkillTools Executes Scripts Without Path Containment Validation...
GHSA-C44F-37QR-GW3F PraisonAI: SkillTools Executes Scripts Without Path Containment Validation
Summary SkillTools.runskillscript accepts a scriptpath parameter and executes it via subprocess.run without any path containment validation. While FileTools has validatepath with traversal detection, SkillTools performs none. An LLM-directed call can execute arbitrary scripts from any filesystem...
GHSA-4GFV-WG42-7JW5 PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow
Summary An unsafe dynamic module loading vulnerability allows an attacker who can control a workflow file and a sibling tools.py to execute arbitrary Python code when the workflow is executed. Details The vulnerability is located in the workflow structured output resolution logic. File:...