CVE-2026-55532

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream validateorigin uses requestorigin.startswithallowed, allowing the attacker-controlled localhost.attacker.com HTTP origin to satisfy the localhost allowlist. A webpage can send Content-Type: text/plain requests...

CVE-2026-55532 PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream validateorigin uses requestorigin.startswithallowed, allowing the attacker-controlled localhost.attacker.com HTTP origin to satisfy the localhost allowlist. A webpage can send Content-Type: text/plain requests...

CVE-2026-55532 PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream validateorigin uses requestorigin.startswithallowed, allowing the attacker-controlled localhost.attacker.com HTTP origin to satisfy the localhost allowlist. A webpage can send Content-Type: text/plain requests...

CVE-2026-55529

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream validateorigin method accepts requestorigin.startswithallowed, so the attacker-controlled localhost.evil.example HTTP origin matches the localhost allowlist. Without an API key, a malicious webpage can submit...

CVE-2026-55529 PraisonAI: Origin validation bypass in MCP HTTP Stream transport allows browser-mediated unauthenticated tool execution on local MCP server

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream validateorigin method accepts requestorigin.startswithallowed, so the attacker-controlled localhost.evil.example HTTP origin matches the localhost allowlist. Without an API key, a malicious webpage can submit...

CVE-2026-55529 PraisonAI: Origin validation bypass in MCP HTTP Stream transport allows browser-mediated unauthenticated tool execution on local MCP server

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream validateorigin method accepts requestorigin.startswithallowed, so the attacker-controlled localhost.evil.example HTTP origin matches the localhost allowlist. Without an API key, a malicious webpage can submit...

CVE-2026-55529 PraisonAI: Origin validation bypass in MCP HTTP Stream transport allows browser-mediated unauthenticated tool execution on local MCP server

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream validateorigin method accepts requestorigin.startswithallowed, so the attacker-controlled localhost.evil.example HTTP origin matches the localhost allowlist. Without an API key, a malicious webpage can submit...

PT-2026-81345

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.58 Description A Cross-Site Request Forgery CSRF issue exists in the MCP HTTP-stream transport. The validate origin function in transports/http stream.py uses a prefix match via startswith to validate the reques...

PT-2026-81320

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.58 Description The MCP HTTP Stream transport in PraisonAI uses an unsafe prefix match when validating the Origin header via the validate origin method. The validation logic accepts any origin that starts with an...

PT-2026-53559

Summary execute code in praisonai-agents runs attacker-controlled Python inside a three-layer sandbox that can be fully bypassed by passing a str subclass with an overridden startswith method to the safe getattr wrapper, achieving arbitrary OS command execution on the host. Details python...

SUSE CVE-2026-40256

Weblate is a web based localization tool. In versions prior to 5.17, repository-boundary validation relies on string prefix checks on resolved absolute paths. In multiple code paths, the check uses startswith against the repository root path. This is not path-segment aware and can be bypassed whe...

GHSA-44FC-8FM5-Q62H Convict has Prototype Pollution via startsWith() function

Summary A prototype pollution vulnerability exists in the latest version of the convict npm package 6.2.4. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input started with a forbidden key, it is still possible to pollute Object.prototype via a...

PT-2026-28540

Name of the Vulnerable Software and Affected Versions convict versions 6.2.4 Description A prototype pollution issue exists in the convict npm package. The issue stems from an incomplete fix that attempted to prevent prototype pollution by checking if user input begins with a prohibited key...

CVE-2022-21190: Improperly Controlled Modification of Object Prototype Attributes

This affects the package convict before 6.2.3. This is a bypass of CVE-2022-22143. The fix introduced, relies on the startsWith method and does not prevent the vulnerability: before splitting the path, it checks if it starts with proto or this.constructor.prototype. To bypass this check it's...

CVE-2020-21526: Improper Limitation of a Pathname to a Restricted Directory

An Arbitrary file writing vulnerability in halo v1.1.3. In an interface to write files in the background, a directory traversal check is performed on the input path parameter, but the startsWith function can be used to bypass it...