CVE-2026-55524: Time-of-check Time-of-use (TOCTOU) Race Condition

PraisonAI is a multi-agent teams system. In versions prior to 1.6.58, the webcrawl tool performs its SSRF check only on the initially supplied URL, allowing the protection to be bypassed so the tool connects to attacker-chosen internal destinations. The check resolves the hostname once with...

PT-2026-68308

Name of the Vulnerable Software and Affected Versions PraisonAI versions 1.5.128 through 1.6.57 Description The web crawl function in praisonaiagents.tools.web crawl tools is susceptible to server-side request forgery SSRF. Although the system validates the initial URL to block direct loopback an...

CVE-2026-55523: Server-Side Request Forgery (SSRF)

PraisonAI is a multi-agent teams system. In versions 1.5.128 through 1.6.57, the praisonaiagents.tools.webcrawltools.webcrawl function is vulnerable to server-side request forgery. While it validates the initially supplied URL and blocks direct loopback and private destinations, its default httpx...

PT-2026-68315

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 1.6.58 Description The web crawl tool contains a Server-Side Request Forgery SSRF flaw. The system performs a security check on the initial URL by resolving the hostname via socket.gethostbyname to reject private,...

PT-2026-68302

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.40 Description The bundled Claude GitHub Actions workflow is susceptible to command injection. This occurs because the workflow embeds a pull request branch name into a Bash run: block without proper quoting or...

PT-2026-68307

Name of the Vulnerable Software and Affected Versions praisonai versions 3.9.26 through 4.6.57 praisonaiagents versions 0.12.12 through 1.6.57 Description The workflow include feature allows for arbitrary Python code execution. The Workflow. execute include function implicitly imports and runs a...

CVE-2026-48168: Missing Authorization

PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Actions workflow is vulnerable to command injection because it embeds an attacker-controlled pull request branch name into a Bash run: block without quoting or validation. Additionally, the workflow...

Remote Code Execution

PraisonAI is vulnerable to Remote Code Execution RCE. The vulnerability is due to loading and executing plugin files without code signing, integrity verification, or sandboxing, allowing attackers to place malicious Python plugins in trusted plugin directories and execute arbitrary code when the...

PYSEC-2026-3500 PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation

Summary The multiedit tool in src/praisonai/praisonai/tools/multiedit.py allows LLM-controlled arbitrary file read and write without any path validation, workspace boundary check, or protected path guard. This enables an attacker who can influence agent tool arguments via crafted prompts, user...

PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation

SummaryThe multiedit tool in src/praisonai/praisonai/tools/multiedit.py allows LLM-controlled arbitrary file read and write without any path validation, workspace boundary check, or protected path guard. This enables an attacker who can influence agent tool arguments via crafted prompts, user inp...

PYSEC-2026-3505 PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml

Summary PraisonAI recipe execution has a dangerous-tool policy that is supposed to block default-denied tools unless the caller explicitly passes allowdangeroustools=True. That policy only checks tools declared in TEMPLATE.yaml requires.tools. For steps-based recipes, the actual execution path...

PYSEC-2026-3512 PraisonAI Code agent tools fail open without a workspace boundary

PraisonAI Code agent tools fail open without a workspace boundary Summary PraisonAI Code's agent-compatible CODETOOLS wrappers keep a global workspace root initialized to None. If an application uses CODETOOLS, codereadfile, codesearchreplace, or codeapplydiff before calling setworkspace, the...

PYSEC-2026-3515 PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default

Summary The published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint: text praisonai serve...

PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion

SummaryPraisonAI's template loader accepts GitHub template URIs with refs, for examplegithub:owner/repo/[email protected]. The resolver stores the user-controlledtemplate path and ref verbatim, and the cache layer later joins those values into/.praison/cache/templates/github//// withoutnormalizing...

PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints

PraisonAI AgentTeam.launch exposes unauthenticated remote agent invocation endpoints SummaryPraisonAI's documented Python AgentTeam.launch / Agents.launch HTTP server starts externally reachable agent invocation endpoints without any authentication enforcement.The current implementation registers...

PYSEC-2026-3517 PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai

Unauthenticated PraisonAI UI MCP connect endpoint executes attacker-chosen local commands Summary PraisonAI v4.6.48 exposes the PraisonAIUI MCP client management API through the default UI host apps without authentication. A remote unauthenticated client can send POST /api/mcp/connect with a...

PYSEC-2026-3537 PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints

PraisonAI AgentTeam.launch exposes unauthenticated remote agent invocation endpoints Summary PraisonAI's documented Python AgentTeam.launch / Agents.launch HTTP server starts externally reachable agent invocation endpoints without any authentication enforcement. The current implementation registe...

PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai

Unauthenticated PraisonAI UI MCP connect endpoint executes attacker-chosen local commands SummaryPraisonAI v4.6.48 exposes the PraisonAIUI MCP client management API through the default UI host apps without authentication. A remote unauthenticated client can send POST /api/mcp/connect with a comma...

PYSEC-2026-3507 PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation

AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation Summary PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm96-6xpr-978x / CVE-2026-40151. The publi...

PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation

AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation SummaryPraisonAI's AgentOS FastAPI deployment surface remains unauthenticated incurrent main and in releases after the published patched version forGHSA-pm96-6xpr-978x / CVE-2026-40151.The public...