Lucene search
+L

137784 matches found

OSV
OSV
added 2026/07/23 11:41 a.m.7 views

PYSEC-2026-3509 PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion

Summary PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/[email protected]. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into /.praison/cache/templates/github//// without...

8.1CVSS5.7AI score
SaveExploits0References5
PyPA
PyPA
added 2026/07/23 11:41 a.m.33 views

PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints

PraisonAI AgentTeam.launch exposes unauthenticated remote agent invocation endpoints SummaryPraisonAI's documented Python AgentTeam.launch / Agents.launch HTTP server starts externally reachable agent invocation endpoints without any authentication enforcement.The current implementation registers...

9.8CVSS5.8AI score
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/23 11:41 a.m.35 views

PraisonAI Code agent tools fail open without a workspace boundary

PraisonAI Code agent tools fail open without a workspace boundary SummaryPraisonAI Code's agent-compatible CODETOOLS wrappers keep a global workspace root initialized to None. If an application uses CODETOOLS, codereadfile, codesearchreplace, or codeapplydiff before calling setworkspace, the...

7.3CVSS5.5AI score
SaveExploits0References5Affected Software1
OSV
OSV
added 2026/07/23 11:41 a.m.8 views

PYSEC-2026-3515 PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default

Summary The published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint: text praisonai serve...

7.5CVSS5.4AI score
SaveExploits0References5
PyPA
PyPA
added 2026/07/23 11:41 a.m.31 views

PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion

SummaryPraisonAI's template loader accepts GitHub template URIs with refs, for examplegithub:owner/repo/[email protected]. The resolver stores the user-controlledtemplate path and ref verbatim, and the cache layer later joins those values into/.praison/cache/templates/github//// withoutnormalizing...

8.1CVSS5.6AI score
SaveExploits0References5Affected Software1
OSV
OSV
added 2026/07/23 11:41 a.m.11 views

PYSEC-2026-3512 PraisonAI Code agent tools fail open without a workspace boundary

PraisonAI Code agent tools fail open without a workspace boundary Summary PraisonAI Code's agent-compatible CODETOOLS wrappers keep a global workspace root initialized to None. If an application uses CODETOOLS, codereadfile, codesearchreplace, or codeapplydiff before calling setworkspace, the...

7.3CVSS5.6AI score
SaveExploits0References5
OSV
OSV
added 2026/07/23 11:41 a.m.7 views

PYSEC-2026-3532 PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters

Summary The email search tool in src/praisonai-agents/praisonaiagents/tools/emailtools.py constructs IMAP SEARCH commands by interpolating LLM-controlled parameters fromaddr, subject, query directly into IMAP protocol strings using f-string formatting with double-quote delimiters. An attacker who...

8.1CVSS5.9AI score
SaveExploits0References5
OSV
OSV
added 2026/07/23 11:41 a.m.10 views

PYSEC-2026-3513 praisonai: recipe serve auth middleware silently disables itself when no secret is set

praisonai: recipe serve authentication middleware silently disables itself when no secret is set Researcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security Research Target: https://github.com/MervinPraison/PraisonAI --- Package: praisonai on PyPI Version tested: 4.6.48...

9.8CVSS6.2AI score
SaveExploits0References5
PyPA
PyPA
added 2026/07/23 11:41 a.m.30 views

PraisonAI: Jobs API exposes agent-execution endpoints with no authentication

praisonai: Jobs API exposes agent-execution endpoints with no authenticationResearcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security Research Target: https://github.com/MervinPraison/PraisonAI---Package: praisonai on PyPIAffected version empirically tested:...

9.8CVSS6.6AI score
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/23 11:41 a.m.29 views

PraisonAI: Unauthenticated Local File Inclusion via agent_file path in PraisonAI Jobs API

SummaryAn unauthenticated attacker can read arbitrary files on the server by supplying an absolute filesystem path in the agentfile field of the Jobs API. The field has no path validation, no allowlist, and no authentication is required to submit jobs. DetailsThe agentfile field in JobSubmitReque...

7.5CVSS5.5AI score
SaveExploits0References5Affected Software1
OSV
OSV
added 2026/07/23 11:41 a.m.10 views

PYSEC-2026-3501 PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass

Unauthenticated Remote Code Execution via Jobs API and Approval Bypass in PraisonAI Summary An unauthenticated attacker can execute arbitrary OS commands on any server running the PraisonAI Jobs API by submitting a crafted workflow YAML. The attack chains two weaknesses: the /api/v1/runs endpoint...

9.8CVSS7.2AI score
SaveExploits0References5
OSV
OSV
added 2026/07/23 11:41 a.m.8 views

PYSEC-2026-3511 PraisonAI: Jobs API exposes agent-execution endpoints with no authentication

praisonai: Jobs API exposes agent-execution endpoints with no authentication Researcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security Research Target: https://github.com/MervinPraison/PraisonAI --- Package: praisonai on PyPI Affected version empirically tested: 4.6.48...

9.8CVSS6.6AI score
SaveExploits0References5
OSV
OSV
added 2026/07/23 11:41 a.m.10 views

PYSEC-2026-3536 PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in

The MCP SSE server started via ToolsMCPServer.runsse / launchtoolsmcpservertransport="sse" binds to 0.0.0.0 by default and builds its Starlette application with no authentication middleware and no Origin-header validation. The module mcp/mcpsecurity.py provides exactly the needed controls origin...

9.8CVSS5.5AI score
SaveExploits0References5
OSV
OSV
added 2026/07/23 11:41 a.m.7 views

PYSEC-2026-3533 PraisonAI: execute_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunder

Summary The executecode tool's subprocess sandbox advertises a three-layer defense AST validation, text-pattern blocklist, restricted builtins. In sandbox mode the default only two layers are active — the text-pattern blocklist is skipped — and both remaining layers are bypassed by combining two...

6.5CVSS5.9AI score
SaveExploits0References5
PyPA
PyPA
added 2026/07/23 11:41 a.m.31 views

PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in

The MCP SSE server started via ToolsMCPServer.runsse / launchtoolsmcpservertransport="sse"binds to 0.0.0.0 by default and builds its Starlette application with no authentication middlewareand no Origin-header validation. The module mcp/mcpsecurity.py provides exactly the needed controlsorigin...

9.8CVSS5.4AI score
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/23 11:41 a.m.28 views

PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass

Unauthenticated Remote Code Execution via Jobs API and Approval Bypass in PraisonAI Summary An unauthenticated attacker can execute arbitrary OS commands on any server runningthe PraisonAI Jobs API by submitting a crafted workflow YAML. The attack chains twoweaknesses: the /api/v1/runs endpoint...

9.8CVSS7.1AI score
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/23 11:41 a.m.32 views

PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass

Unauthenticated Remote Code Execution via Jobs API and Approval Bypass in PraisonAI Summary An unauthenticated attacker can execute arbitrary OS commands on any server runningthe PraisonAI Jobs API by submitting a crafted workflow YAML. The attack chains twoweaknesses: the /api/v1/runs endpoint...

9.8CVSS7.1AI score
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/23 11:41 a.m.30 views

PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding

Jobs webhook SSRF protection bypass via DNS rebinding SummaryPraisonAI's Async Jobs API validates webhookurl when a job request is parsedand again when the internal Job object is constructed. That validation blocksdirect loopback/private targets, but it is not bound to the later networkrequest...

7.2CVSS5.6AI score
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/23 11:41 a.m.27 views

PraisonAI: execute_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunder

SummaryThe executecode tool's subprocess sandbox advertises a three-layer defense AST validation, text-pattern blocklist, restricted builtins. In sandbox mode the default only two layers are active — the text-pattern blocklist is skipped — and both remaining layers are bypassed by combining two...

6.5CVSS5.8AI score
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/23 11:41 a.m.31 views

praisonai: recipe serve auth middleware silently disables itself when no secret is set

praisonai: recipe serve authentication middleware silently disables itself when no secret is setResearcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security ResearchTarget: https://github.com/MervinPraison/PraisonAI---Package: praisonai on PyPIVersion tested: 4.6.48.File:...

9.8CVSS6.1AI score
SaveExploits0References5Affected Software1
Rows per page
Query Builder