EUVD-2026-78424

PraisonAI is a multi-agent teams system. From praisonaiagents 0.6.0 until 1.6.59 and PraisonAI 3.10.0 until 4.6.59, ToolsMCPServer.runsse in src/praisonai-agents/praisonaiagents/mcp/mcpserver.py mounts SseServerTransport on the legacy /sse and /messages/ endpoints without default Host, Origin, or...

CVE-2026-57128

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the SSE server in src/praisonai-agents/praisonaiagents/server/server.py does not consult ServerConfig.authtoken before handling /publish, /events, or /info requests. A network client that can reach the server can broadcast...

CVE-2026-57130

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai-agents/praisonaiagents/tools/emailtools.py interpolates LLM-controlled fromaddr, subject, and query values directly into quoted IMAP SEARCH criteria. Embedded quote, backslash, newline, or null characters can...

CVE-2026-57126

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, SpiderTools.validateurl calls hostisblocked, which checks literal host encodings but does not resolve DNS names before scrapepage, crawl, extractlinks, extracttext, or URL-mention fetches connect. An attacker-controlled...

CVE-2026-57129 PraisonAI: Arbitrary File Read via `@file:` Mention Path Traversal

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, MentionsParser.processfilemention accepts file-mention values and falls back from workspace-relative resolution to Pathfilepath without traversal, symlink, or workspace-boundary validation. Prompt input from users, bots, or...

CVE-2026-57126

PraisonAI 's multi-agent system (packages praisonaiagents ≤ 1.6.39 / PraisonAI ≤ 4.6.39) is affected by a CWE-918 SSRF in SpiderTools._validate_url (praisonaiagents/tools/spider_tools.py). The guard (_host_is_blocked) checks only literal IP encodings and never resolves DNS names , so an attacker-...

CVE-2026-57126 praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, SpiderTools.validateurl calls hostisblocked, which checks literal host encodings but does not resolve DNS names before scrapepage, crawl, extractlinks, extracttext, or URL-mention fetches connect. An attacker-controlled...

CVE-2026-57126 praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, SpiderTools.validateurl calls hostisblocked, which checks literal host encodings but does not resolve DNS names before scrapepage, crawl, extractlinks, extracttext, or URL-mention fetches connect. An attacker-controlled...

EUVD-2026-77541

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, executecode sandbox mode permits runtime assembly of blocklisted dunder names and allows str.format or str.formatmap to resolve dotted fields through C-level attribute access that bypasses safegetattr. This exposes class,...

CVE-2026-57128 PraisonAI: Unauthenticated Event Injection via SSE `/publish` Endpoint

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the SSE server in src/praisonai-agents/praisonaiagents/server/server.py does not consult ServerConfig.authtoken before handling /publish, /events, or /info requests. A network client that can reach the server can broadcast...

EUVD-2026-77533

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the SSE server in src/praisonai-agents/praisonaiagents/server/server.py does not consult ServerConfig.authtoken before handling /publish, /events, or /info requests. A network client that can reach the server can broadcast...

CVE-2026-57115

PraisonAI (the praisonaiagents Python package) is a multi-agent team system. The vulnerability is an SSRF protection bypass in SpiderTools.scrape_page() (component: spider_tools.py). The method validates the initial URL to block loopback, private, link-local, and metadata addresses, but then call...

CVE-2026-57115 PraisonAI: SpiderTools redirect-target SSRF protection bypass

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, SpiderTools.scrapepage validates only the initial URL and lets requests.Session.get follow redirects automatically, so a public-looking URL can redirect to a loopback, private, link-local, or metadata address without...

CVE-2026-57130: Improper Input Validation

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai-agents/praisonaiagents/tools/emailtools.py interpolates LLM-controlled fromaddr, subject, and query values directly into quoted IMAP SEARCH criteria. Embedded quote, backslash, newline, or null characters can...

CVE-2026-57125: Missing Authentication for Critical Function

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.59 and praisonaiagents 1.6.59, the unauthenticated POST /api/v1/runs Jobs API accepts attacker-controlled agentyaml, and the approve field can mark executecommand as YAML-approved before @requireapproval checks critical tools. This...

praisonaiagents vulnerable to arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location

Summarypraisonaiagents/memory/filememory.py::FileMemory.init constructs allmemory file paths by directly joining the userid parameter to a base path:pythonself.userpath = self.basepath / userid LINE 145 — no sanitizationNo validation or normalization is applied to userid before the path join.An...

PYSEC-2026-3902 praisonaiagents vulnerable to arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location

Summary praisonaiagents/memory/filememory.py::FileMemory.init constructs all memory file paths by directly joining the userid parameter to a base path: python self.userpath = self.basepath / userid LINE 145 — no sanitization No validation or normalization is applied to userid before the path join...

praisonaiagents vulnerable to SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap)

The webcrawl tool performs its SSRF check only on the initial URL: it resolves the hostname oncewith socket.gethostbyname and rejects private/loopback/link-local results. It then passes the URL toa fetcher that uses httpx.Clientfollowredirects=True - or urllib.request.urlopen when httpx isabsent,...

praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)

Summarypraisonaiagents/tools/spidertools.py contains an SSRF protection bypass. The functionhostisblocked validates URLs against a list of blocked IP literals and hostnamealiases, but never performs DNS resolution. Any hostname that resolves to a private orloopback IP address — including public...

praisonaiagents: AgentServer declares auth_token but never enforces it on any route

Researcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security ResearchTarget: https://github.com/MervinPraison/PraisonAI---Package: praisonaiagents on PyPIAffected version empirically tested: 1.6.48Component: praisonaiagents.server.AgentServer the bundled HTTP / SSE server---...