PT-2026-61788

Summary The published npm package praisonai exports an MCPSecurity helper described in source as: text MCP Security - Authentication, authorization, and rate limiting Provides security policies for MCP servers. Its AuthMethod type advertises five authentication methods: ts export type AuthMethod ...

PT-2026-61789

Summary The published npm package praisonai exports a TypeScript SandboxExecutor with a network-isolated mode. The CLI lists that mode as: text network-isolated No network access proxy blocked The implementation does not create a network namespace, firewall rule, socket filter, or proxy-enforced...

PT-2026-61790

Summary The published npm package praisonai exports SandboxExecutor, CommandValidator, and sandboxExec as "safe command execution with restrictions." When allowedCommands is configured, CommandValidator checks only the first whitespace-delimited token of the command string. SandboxExecutor then...

PT-2026-61792

Name of the Vulnerable Software and Affected Versions PraisonAI versions 1.4.0 through 1.7.1 Description The codeMode function in src/praisonai-ts/src/tools/builtins/code-mode.ts executes untrusted JavaScript using new Function within a withsandbox block. The system relies on a limited source-cod...

PT-2026-61793

Name of the Vulnerable Software and Affected Versions PraisonAI versions 1.5.0 through 1.7.1 Description In the multi-agent teams system, the MCPServer.startHttp function in src/praisonai-ts/src/mcp/server.ts binds without host restrictions and forwards all HTTP POST requests to the handleRequest...

PT-2026-61795

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 1.7.2 Description The codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts executes model-generated JavaScript using new Function and a withsandbox pattern. The implementation relies on a...

PT-2026-61769

Name of the Vulnerable Software and Affected Versions PraisonAI versions 3.9.24 through 4.6.57 Description Server-Side Request Forgery SSRF is possible in the SpiderTools.scrape page function, which is also utilized by extract links, crawl, and extract text. While the software validates the initi...

PT-2026-61784

Name of the Vulnerable Software and Affected Versions praisonai-agents affected versions not specified Description The email search tool in src/praisonai-agents/praisonaiagents/tools/email tools.py is susceptible to IMAP injection. The issue occurs because the tool constructs IMAP SEARCH commands...

PT-2026-61764

Name of the Vulnerable Software and Affected Versions praisonai versions 3.9.24 through 4.6.57 Description The CODE TOOLS wrappers in PraisonAI Code fail open when a workspace boundary is not explicitly set. If an application utilizes CODE TOOLS, code read file, code search replace, or code apply...

PT-2026-61774

Name of the Vulnerable Software and Affected Versions praisonai-agents affected versions not specified Description The execute code tool contains a flaw in its subprocess sandbox that allows an arbitrary read primitive over blocklisted attributes. The issue arises from the combination of two...

PT-2026-61778

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands...

PT-2026-53130

Summary Setting PRAISONAI CALL AUTH=disabled completely disables all authentication on the /api/v1/agents/id/invoke endpoint. This bypass is advertised in the application's own error messages, making it likely to appear in production Docker and Compose configurations. Details python...

PT-2026-61770

Name of the Vulnerable Software and Affected Versions praisonai versions 4.2.1 through 4.6.57 Description The AgentOS FastAPI deployment surface fails to implement authentication, allowing unauthenticated remote users to invoke agents. This issue persists in versions previously reported as patche...

PT-2026-53124

Summary The published npm package praisonai ships dist/tools/utility-tools.js, which exports a shellcommand helper described in source as: text Execute shell command safe version - read-only commands The helper attempts to enforce a safe read-only command allowlist by checking only the first...

PT-2026-50807

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 1.5.128 Description A cross-origin agent execution issue exists in the 'POST /agui' endpoint, allowing remote attackers to trigger arbitrary agent execution. The endpoint lacks authentication and utilizes hardcoded...

PT-2026-50806

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.5.128 Description An arbitrary shell command execution issue exists where UI modules hardcode approval mode to auto, which overrides the administrator configuration set in the PRAISON APPROVAL MODE environment...

CVE-2026-56074: Incorrect Authorization

PraisonAI before 1.5.128 caches tool approval decisions by tool name only, not by invocation arguments, allowing subsequent executecommand calls to bypass approval prompts. Attackers can exploit this by obtaining initial approval for a benign command, then silently exfiltrate API keys and...

CVE-2026-56076: Permissive Cross-domain Policy with Untrusted Domains

PraisonAI before 1.5.128 contains a cross-origin agent execution vulnerability in the AGUI endpoint that allows remote attackers to trigger arbitrary agent execution. The POST /agui endpoint lacks authentication and hardcodes Access-Control-Allow-Origin: headers, combined with Starlette's...

CVE-2026-56075: Incorrect Authorization

PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI modules hardcode approvalmode to auto, overriding administrator configuration from PRAISONAPPROVALMODE environment variable. Authenticated attackers can instruct the LLM agent to execute arbitrary...

CVE-2026-56077: Exposure of Resource to Wrong Sphere

PraisonAI before 1.5.115 contains an information disclosure vulnerability in the MultiAgentLedger component that allows attackers to access sensitive data by registering agents with duplicate IDs. Attackers can exploit the lack of agent ID uniqueness enforcement to share ledger instances and expo...