CVE-2026-40112 PraisonAI has Stored XSS via Unsanitized Agent Output in HTML Rendering (nh3 Not a Required Dependency)

PraisonAI is a multi-agent teams system. Prior to 4.5.128, the Flask API endpoint in src/praisonai/api.py renders agent output as HTML without effective sanitization. The sanitizehtml function relies on the nh3 library, which is not listed as a required or optional dependency in pyproject.toml...

PT-2025-12320 · Autogpt +1 · Autogpt +1

Name of the Vulnerable Software and Affected Versions: AutoGPT versions 0.3.4 and earlier Description: AutoGPT versions 0.3.4 and earlier are susceptible to a Server-Side Template Injection SSTI that could lead to Remote Code Execution RCE. This issue stems from the inadequate handling of...