PYSEC-2026-3516 PraisonAI: Unauthenticated Local File Inclusion via agent_file path in PraisonAI Jobs API

Summary An unauthenticated attacker can read arbitrary files on the server by supplying an absolute filesystem path in the agentfile field of the Jobs API. The field has no path validation, no allowlist, and no authentication is required to submit jobs. Details The agentfile field in...

PYSEC-2026-3529 PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass

Unauthenticated Remote Code Execution via Jobs API and Approval Bypass in PraisonAI Summary An unauthenticated attacker can execute arbitrary OS commands on any server running the PraisonAI Jobs API by submitting a crafted workflow YAML. The attack chains two weaknesses: the /api/v1/runs endpoint...

PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding

Jobs webhook SSRF protection bypass via DNS rebinding SummaryPraisonAI's Async Jobs API validates webhookurl when a job request is parsedand again when the internal Job object is constructed. That validation blocksdirect loopback/private targets, but it is not bound to the later networkrequest...

PYSEC-2026-3501 PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass

Unauthenticated Remote Code Execution via Jobs API and Approval Bypass in PraisonAI Summary An unauthenticated attacker can execute arbitrary OS commands on any server running the PraisonAI Jobs API by submitting a crafted workflow YAML. The attack chains two weaknesses: the /api/v1/runs endpoint...

PYSEC-2026-3511 PraisonAI: Jobs API exposes agent-execution endpoints with no authentication

praisonai: Jobs API exposes agent-execution endpoints with no authentication Researcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security Research Target: https://github.com/MervinPraison/PraisonAI --- Package: praisonai on PyPI Affected version empirically tested: 4.6.48...

PraisonAI: Unauthenticated Local File Inclusion via agent_file path in PraisonAI Jobs API

SummaryAn unauthenticated attacker can read arbitrary files on the server by supplying an absolute filesystem path in the agentfile field of the Jobs API. The field has no path validation, no allowlist, and no authentication is required to submit jobs. DetailsThe agentfile field in JobSubmitReque...

PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass

Unauthenticated Remote Code Execution via Jobs API and Approval Bypass in PraisonAI Summary An unauthenticated attacker can execute arbitrary OS commands on any server runningthe PraisonAI Jobs API by submitting a crafted workflow YAML. The attack chains twoweaknesses: the /api/v1/runs endpoint...

PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass

Unauthenticated Remote Code Execution via Jobs API and Approval Bypass in PraisonAI Summary An unauthenticated attacker can execute arbitrary OS commands on any server runningthe PraisonAI Jobs API by submitting a crafted workflow YAML. The attack chains twoweaknesses: the /api/v1/runs endpoint...

PYSEC-2026-3519 PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding

Jobs webhook SSRF protection bypass via DNS rebinding Summary PraisonAI's Async Jobs API validates webhookurl when a job request is parsed and again when the internal Job object is constructed. That validation blocks direct loopback/private targets, but it is not bound to the later network reques...

PYSEC-2026-3536 PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in

The MCP SSE server started via ToolsMCPServer.runsse / launchtoolsmcpservertransport="sse" binds to 0.0.0.0 by default and builds its Starlette application with no authentication middleware and no Origin-header validation. The module mcp/mcpsecurity.py provides exactly the needed controls origin...

PYSEC-2026-3520 PraisonAI recipe.run_stream skips dangerous-tool policy enforcement

PraisonAI recipe.runstream skips dangerous-tool policy enforcement Summary PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explicitly passes allowdangeroustools=True. The normal recipe.run path enforces this with checktoolpolicy. The streaming path,...

PYSEC-2026-3502 PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard

PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard Summary PraisonAI's installed console entrypoint is Typer-first. In current releases, the recipe command is registered in the Typer app and praisonai recipe serve dispatches to the deprecated Typer command in...

PYSEC-2026-3510 PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing

PraisonAI LinearBot processes unsigned webhooks when LINEARWEBHOOKSECRET is missing Summary PraisonAI's LinearBot starts a public webhook listener on 0.0.0.0 and treats LINEARWEBHOOKSECRET as optional. When the secret is absent, startup only logs a warning and handlewebhook skips Linear-Signature...

PYSEC-2026-3514 PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage

PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage Summary PraisonAI's Dynamic Context Discovery feature exposes artifact helper tools through ctx.gettools: python ctx = setupdynamiccontext agent = Agent instructions="You are a data analyst.",...

PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage

PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage SummaryPraisonAI's Dynamic Context Discovery feature exposes artifact helper toolsthrough ctx.gettools:pythonctx = setupdynamiccontextagent = Agent instructions="You are a data analyst.", tools=ctx.gettool...

PraisonAI Slack app_mention bypasses configured user/channel authorization

PraisonAI Slack appmention bypasses configured user/channel authorization SummaryPraisonAI's Slack bot applies its configured allowedusers,allowedchannels, and unknown-user pairing policy in the normal Slackmessage event handler, but not in the adjacent Slack appmention eventhandler.A Slack...

PraisonAI recipe.run_stream skips dangerous-tool policy enforcement

PraisonAI recipe.runstream skips dangerous-tool policy enforcement SummaryPraisonAI recipe execution blocks default-denied dangerous tools unless thecaller explicitly passes allowdangeroustools=True. The normal recipe.runpath enforces this with checktoolpolicy. The streaming path,recipe.runstream...

PYSEC-2026-3522 PraisonAI: Compute-bridged file tools allow shell command injection

Compute-bridged file tools allow shell command injection Summary LocalManagedAgent / SandboxedAgent compute bridging wraps readfile, listfiles, and writefile when a compute provider is attached. The bridge converts those file operations into shell command strings using raw path arguments, then...

PYSEC-2026-3534 PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools

PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools Summary praisonaiagents.mcp.ToolsMCPServer.runsse builds a Starlette MCP HTTP+SSE server around mcp.server.sse.SseServerTransport. The server exposes /sse and /messages/, but it does not valida...

PYSEC-2026-3499 PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal

PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal Summary PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The SDK reference describes the module as providing: - artifact storage for tool...