1771 matches found
GHSA-4XXV-6WMF-XF45 PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace
FastContext path resolution permits absolute and traversal reads outside the workspace Summary PraisonAI's praisonaiagents.context.fast FastContext feature treats workspacepath as the root directory for code search, but its model-facing search tools and high-level readcontext helper accept absolu...
EUVD-2026-42898
PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace...
GHSA-M6WP-H223-4C8G PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification
Summary The plugin manager loads and executes arbitrary .py files from .praisonai/plugins/ directories both project-level and user home via importlib.util.specfromfilelocation + execmodule with zero code signing, integrity verification, or sandboxing. Any attacker who can write a file to the...
PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification
Summary The plugin manager loads and executes arbitrary .py files from .praisonai/plugins/ directories both project-level and user home via importlib.util.specfromfilelocation + execmodule with zero code signing, integrity verification, or sandboxing. Any attacker who can write a file to the...
GHSA-2XV2-W8CQ-5GXW PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets
Summary CodeAgent.executepython executes LLM-generated Python code in a subprocess with the complete parent-process environment os.environ.copy, zero AST validation, zero import restrictions, and no sandbox enforcement — even when CodeConfigsandbox=True is explicitly set. This allows an attacker...
GHSA-29R9-67VG-QJ56 PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments
Summary PraisonAI gates dangerous tools file writes, deletes, shell/code execution behind an interactive approval prompt. The first approval of a tool is cached for the remainder of the run and silently reused for all later invocations of that tool with arbitrary, unreviewed arguments. Root cause...
EUVD-2026-44637
PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments...
GHSA-QG25-6GC4-48MG PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure
Summary PraisonAI's webcrawl agent tool performs a server-side HTTP fetch of an agent/attacker-influenced URL. SSRF is meant to be prevented by issafecrawlurl, which resolves the hostname and rejects private/loopback/link-local IPs at validation time. The validated value is the URL string not a...
EUVD-2026-44639
PraisonAI: DNS rebinding bypass in webcrawl SSRF protection allows internal response disclosure...
GHSA-QJW5-XWRP-XWPQ PraisonAI: Project config can auto-save agent output outside the project root
Project config can auto-save agent output outside the project root Summary praisonaiagents automatically reads project-local .praisonai/config.toml defaults when constructing an Agent. A repository-controlled config can set defaults.output.outputfile to an absolute path or a .. traversal path. Wh...
EUVD-2026-42895
PraisonAI: Project config can auto-save agent output outside the project root...
Prompt Injection Bypass
PraisonAI is vulnerable to a Prompt Injection Bypass. The vulnerability is due to the block threshold defaulting to CRITICAL severity, which allows an attacker to submit instruction override or financial manipulation prompts that evade blocking, potentially enabling system prompt extraction and...
PT-2026-108711
Name of the Vulnerable Software and Affected Versions praisonai versions 4.5.128 through 4.6.63 Description The API deployment generator in PraisonAI improperly embeds configuration values from agents.yaml directly into generated Python source code without safe encoding. This allows a malicious...
PT-2026-108716
Name of the Vulnerable Software and Affected Versions praisonai-platform versions 0.1.6 through 0.1.8 Description An authorization gap allows ordinary workspace members to modify shared labels and manage label assignments on issues created by owners or administrators. While direct label deletion ...
PT-2026-108713
Name of the Vulnerable Software and Affected Versions praisonai version 4.6.63 Description The Async Jobs API fails to enforce authentication by default, as the API-key middleware is only active when the PRAISONAI JOBS API KEY environment variable is set. This allows unauthenticated access to the...
PT-2026-108712
Name of the Vulnerable Software and Affected Versions praisonai version 4.6.62 Description An authentication bypass exists in the n8n/call agent invocation API when the PRAISONAI CALL AUTH=disabled setting is enabled. The system attempts to restrict this opt-out to localhost bindings by checking...
PT-2026-108707
Name of the Vulnerable Software and Affected Versions PraisonAI affected versions not specified Description Dangerous tools such as file writes and deletes are protected by an interactive approval prompt. However, the first approval of a tool is cached for the duration of the run and reused for...
PT-2026-108715
Name of the Vulnerable Software and Affected Versions praisonai version 4.6.63 Description The MCP HTTP-stream server fails to enforce authentication by default because the --api-key CLI argument defaults to None. This allows unauthenticated requests to the /mcp endpoint, enabling attackers to...
PT-2026-108710
Name of the Vulnerable Software and Affected Versions PraisonAI version 4.6.63 Description The web crawl agent tool is susceptible to Server-Side Request Forgery SSRF with internal response disclosure. The issue arises because the is safe crawl url function validates the hostname by resolving it ...