PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source

API deploy code generator embeds unescaped YAML fields into Python source SummaryPraisonAI's API deployment generator copies deploy.api.host from agents.yaml directly into generated Python source without safe literal encoding. A malicious PraisonAI project can set that host value to a Python...

PraisonAI: Project custom command templates can read outside-workspace files into model prompts

Project custom command templates can read outside-workspace files into model prompts SummaryPraisonAI's new file-based custom command feature auto-discovers project commands from .praisonai/commands/.md. When a user runs praisonai run --command inside a repository, the command body is interpolate...

PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace

ContextGatherer include resolution permits absolute and traversal reads outside the workspace SummaryPraisonAI's praisonai.ui.context.ContextGatherer treats the configured directory as the project workspace, but project-controlled .praisoncontext and .praisoninclude files can name absolute paths ...

PraisonAI: Call API localhost-only authentication bypass via spoofed Host header

Call API localhost-only authentication bypass via spoofed Host header SummaryPraisonAI's patched PRAISONAICALLAUTH=disabled safeguard for the n8n/call agent invocation API can be bypassed with a spoofed Host: 127.0.0.1 header, allowing an unauthenticated network caller to list and invoke register...

PYSEC-2026-4247 PraisonAI: Call API localhost-only authentication bypass via spoofed Host header

Call API localhost-only authentication bypass via spoofed Host header Summary PraisonAI's patched PRAISONAICALLAUTH=disabled safeguard for the n8n/call agent invocation API can be bypassed with a spoofed Host: 127.0.0.1 header, allowing an unauthenticated network caller to list and invoke...

PYSEC-2026-4258 PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace

ContextGatherer include resolution permits absolute and traversal reads outside the workspace Summary PraisonAI's praisonai.ui.context.ContextGatherer treats the configured directory as the project workspace, but project-controlled .praisoncontext and .praisoninclude files can name absolute paths...

PYSEC-2026-4251 PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source

API deploy code generator embeds unescaped YAML fields into Python source Summary PraisonAI's API deployment generator copies deploy.api.host from agents.yaml directly into generated Python source without safe literal encoding. A malicious PraisonAI project can set that host value to a Python...

PYSEC-2026-4261 PraisonAI: Project custom command templates can read outside-workspace files into model prompts

Project custom command templates can read outside-workspace files into model prompts Summary PraisonAI's new file-based custom command feature auto-discovers project commands from .praisonai/commands/.md. When a user runs praisonai run --command inside a repository, the command body is interpolat...

PYSEC-2026-4260 PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL

PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL Summary The PGVector and Cassandra knowledge-store backends validate SQL/CQL identifiers such as schema, keyspace, and collection names, but still insert the caller-controlled dimension argument directly into CREATE...

Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl

SummarySeveral remote-content download paths in Pydantic AI buffered the entire HTTP response body into memory before enforcing any size limit. An application that exposes the local web-fetch tool webfetchtool, or the WebFetch capability's local fallback to untrusted prompts can be driven to fetc...

PraisonAI: SkillTools Executes Scripts Without Path Containment Validation

SummarySkillTools.runskillscript accepts a scriptpath parameter and executes it via subprocess.run without any path containment validation. While FileTools has validatepath with traversal detection, SkillTools performs none. An LLM-directed call can execute arbitrary scripts from any filesystem...

Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl

SummarySeveral remote-content download paths in Pydantic AI buffered the entire HTTP response body into memory before enforcing any size limit. An application that exposes the local web-fetch tool webfetchtool, or the WebFetch capability's local fallback to untrusted prompts can be driven to fetc...

PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL

PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL SummaryThe PGVector and Cassandra knowledge-store backends validate SQL/CQL identifiers such as schema, keyspace, and collection names, but still insert the caller-controlled dimension argument directly into CREATE TAB...

PYSEC-2026-4280 Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl

Summary Several remote-content download paths in Pydantic AI buffered the entire HTTP response body into memory before enforcing any size limit. An application that exposes the local web-fetch tool webfetchtool, or the WebFetch capability's local fallback to untrusted prompts can be driven to fet...

PYSEC-2026-4289 Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl

Summary Several remote-content download paths in Pydantic AI buffered the entire HTTP response body into memory before enforcing any size limit. An application that exposes the local web-fetch tool webfetchtool, or the WebFetch capability's local fallback to untrusted prompts can be driven to fet...

PYSEC-2026-4270 PraisonAI: SkillTools Executes Scripts Without Path Containment Validation

Summary SkillTools.runskillscript accepts a scriptpath parameter and executes it via subprocess.run without any path containment validation. While FileTools has validatepath with traversal detection, SkillTools performs none. An LLM-directed call can execute arbitrary scripts from any filesystem...

PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace

FastContext path resolution permits absolute and traversal reads outside the workspace SummaryPraisonAI's praisonaiagents.context.fast FastContext feature treats workspacepath as the root directory for code search, but its model-facing search tools and high-level readcontext helper accept absolut...

PYSEC-2026-4267 PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow

Summary An unsafe dynamic module loading vulnerability allows an attacker who can control a workflow file and a sibling tools.py to execute arbitrary Python code when the workflow is executed. Details The vulnerability is located in the workflow structured output resolution logic. File:...

PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow

SummaryAn unsafe dynamic module loading vulnerability allows an attacker who can control a workflow file and a sibling tools.py to execute arbitrary Python code when the workflow is executed. DetailsThe vulnerability is located in the workflow structured output resolution logic.File:...

PYSEC-2026-4268 PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace

FastContext path resolution permits absolute and traversal reads outside the workspace Summary PraisonAI's praisonaiagents.context.fast FastContext feature treats workspacepath as the root directory for code search, but its model-facing search tools and high-level readcontext helper accept absolu...