PT-2026-61796

Name of the Vulnerable Software and Affected Versions praisonai versions 4.5.87 through 4.6.57 Description A policy bypass exists in the recipe execution process where the dangerous-tool policy fails to inspect the workflow file. While the system is designed to block default-denied tools unless...

PT-2026-53135

Summary PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/[email protected]. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into /.praison/cache/templates/github//// without...

PT-2026-61765

Name of the Vulnerable Software and Affected Versions PraisonAI versions 4.5.2 through 4.6.57 Description The praisonai.bots.HTTPApproval component renders pending tool approval arguments directly into the dashboard HTML without proper escaping. This allows an attacker to inject JavaScript via to...

CVE-2026-56078: Improper Limitation of a Pathname to a Restricted Directory

PraisonAI before 1.5.115 contains a path traversal vulnerability in MultiAgentMonitor that fails to sanitize agent IDs when building file paths. Attackers can include traversal sequences like ../ in agent IDs to read, write, or overwrite arbitrary files, enabling sensitive disclosure, denial of...

PT-2026-53137

PraisonAI Code agent tools fail open without a workspace boundary Summary PraisonAI Code's agent-compatible CODE TOOLS wrappers keep a global workspace root initialized to None. If an application uses CODE TOOLS, code read file, code search replace, or code apply diff before calling set workspace...

PT-2026-53133

praisonai-platform: default JWT signing secret dev-secret-change-me Researcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security Research Target: https://github.com/MervinPraison/PraisonAI --- Package: praisonai-platform on PyPI Latest version and version tested: 0.1.4,...

PT-2026-53153

PraisonAI AgentTeam.launch exposes unauthenticated remote agent invocation endpoints Summary PraisonAI's documented Python AgentTeam.launch / Agents.launch HTTP server starts externally reachable agent invocation endpoints without any authentication enforcement. The current implementation registe...

PT-2026-53122

Unauthenticated Remote Code Execution via Jobs API and Approval Bypass in PraisonAI Summary An unauthenticated attacker can execute arbitrary OS commands on any server running the PraisonAI Jobs API by submitting a crafted workflow YAML. The attack chains two weaknesses: the /api/v1/runs endpoint...

PT-2026-53117

Summary The multiedit tool in src/praisonai/praisonai/tools/multiedit.py allows LLM-controlled arbitrary file read and write without any path validation, workspace boundary check, or protected path guard. This enables an attacker who can influence agent tool arguments via crafted prompts, user...

PT-2026-61791

Summary The published npm package praisonai exports createAgentLoop, whose onToolCall callback is documented and exampled as an approval hook. The implementation calls PraisonAI's generateText wrapper with the caller's executable tools first, receives toolResults, and only then calls onToolCall...

PT-2026-61773

Name of the Vulnerable Software and Affected Versions PraisonAI affected versions not specified Description An unauthenticated attacker can read arbitrary files on the server by providing an absolute filesystem path in the agent file field of the Jobs API. The system lacks path validation and an...

PT-2026-61794

Summary The published npm package praisonai ships a TypeScript AgentOS HTTP server that defaults to host: "0.0.0.0" and registers sensitive agent routes without any authentication or authorization middleware. When a developer starts AgentOS, a network attacker who can reach the service can: - rea...

PT-2026-53148

Jobs webhook SSRF protection bypass via DNS rebinding Summary PraisonAI's Async Jobs API validates webhook url when a job request is parsed and again when the internal Job object is constructed. That validation blocks direct loopback/private targets, but it is not bound to the later network...

PT-2026-53136

PraisonAI LinearBot processes unsigned webhooks when LINEAR WEBHOOK SECRET is missing Summary PraisonAI's LinearBot starts a public webhook listener on 0.0.0.0 and treats LINEAR WEBHOOK SECRET as optional. When the secret is absent, startup only logs a warning and handle webhook skips...

PT-2026-61757

Name of the Vulnerable Software and Affected Versions praisonai versions 4.5.2 through 4.6.58 Description The praisonai.bots.DiscordApproval component improperly handles approval requests for dangerous tool calls. It approves a pending request if any non-bot message containing approval text, such...

PT-2026-61760

Name of the Vulnerable Software and Affected Versions praisonai versions 3.11.0 through 4.6.58 Description The Slack bot in PraisonAI fails to apply configured user and channel authorization policies when processing app mention events. While the standard message event handler correctly enforces...

PT-2026-61763

Name of the Vulnerable Software and Affected Versions PraisonAI versions 4.5.87 through 4.6.57 Description The recipe.run stream function fails to enforce the dangerous-tool policy, allowing recipes to execute tools that are denied by default. While the standard recipe.run path uses check tool...

PT-2026-61771

Name of the Vulnerable Software and Affected Versions praisonai versions 4.6.10 through 4.6.57 Description In LocalManagedAgent and SandboxedAgent, the compute bridging mechanism converts file operations into shell command strings using raw path arguments. This allows an attacker who can influenc...

PT-2026-53146

PraisonAI Slack app mention bypasses configured user/channel authorization Summary PraisonAI's Slack bot applies its configured allowed users, allowed channels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack app mention event handler. A...

PT-2026-53149

PraisonAI recipe.run stream skips dangerous-tool policy enforcement Summary PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explicitly passes allow dangerous tools=True. The normal recipe.run path enforces this with check tool policy. The streaming path,...