praisonai
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- PyPI
- Vulnerability status
- 207 advisory(ies) without a verdict
Advisories (207)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-22cj-m4wf-fv2c PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal | 3.8.1 – < 4.6.59 | Undetermined |
| GHSA-2763-cj5r-c79m PraisonAI Vulnerable to OS Command Injection | < 4.5.121 | Undetermined |
| GHSA-29w3-p9w9-wc47 PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation | < 4.6.61 | Undetermined |
| GHSA-2g3w-cpc4-chr4 PraisonAI Vulnerable to Implicit Execution of Arbitrary Code via Automatic `tools.py` Loading | < 4.5.128 | Undetermined |
| GHSA-2gpf-2492-q9jh PraisonAI: Call API localhost-only authentication bypass via spoofed Host header | < 4.6.78 | Undetermined |
| GHSA-2jgc-f764-c5r2 PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete | < 4.6.58 | Undetermined |
| GHSA-2xgv-5cv2-47vv PraisonAI has Unrestricted Upload Size in WSGI Recipe Registry Server that Enables Memory Exhaustion DoS | < 4.5.128 | Undetermined |
| GHSA-32vr-5gcf-3pw2 PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading | < 4.5.115 | Undetermined |
| GHSA-3643-7v76-5cj2 PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries | 2.4.1 – < 4.6.34 | Undetermined |
| GHSA-3c4r-6p77-xwr7 PraisonAI Vulnerable to Code Injection and Protection Mechanism Failure | < 4.5.128 | Undetermined |
| GHSA-4869-x4pr-q22x PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass | < 4.6.59 | Undetermined |
| GHSA-4mr5-g6f9-cfrh PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode) | < 4.6.40 | Undetermined |
| GHSA-4ph2-f6pf-79wv PraisonAI Has Arbitrary File Write (Zip Slip) in Templates Extraction | < 4.5.113 | Undetermined |
| GHSA-4r3p-w3mc-5v34 PraisonAI: Prompt-injection defense blocks only when 3+ detector families fire simultaneously; realistic single-vector injections pass through unblocked | < 4.6.78 | Undetermined |
| GHSA-4rx4-4r3x-6534 PraisonAI recipe registry pull path traversal writes files outside the chosen output directory | < 4.5.113 | Undetermined |
| GHSA-4w49-gwv8-fpjg PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF | < 4.6.78 | Undetermined |
| GHSA-4wr3-f4p3-5wjh PraisonAI: Unauthenticated Allow-List Manipulation Bypasses Agent Tool Approval Safety Controls | < 4.5.128 | Undetermined |
| GHSA-5c6w-wwfq-7qqm PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings | < 4.6.40 | Undetermined |
| GHSA-5cxw-77wg-jrf3 PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context | < 4.6.40 | Undetermined |
| GHSA-5qw8-f2g9-ff29 PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard | 4.5.112 – < 4.6.59 | Undetermined |
| GHSA-5r6c-gj4g-r697 PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend | < 4.6.78 | Undetermined |
| GHSA-63v4-w882-g4x2 PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools | 4.5.2 – < 4.6.59 | Undetermined |
| GHSA-693f-pf34-72c5 PraisonAI Has Path Traversal in FileTools | < 1.5.113 | Undetermined |
| GHSA-6g6r-q6gw-w8fg PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92) | < 4.6.58 | Undetermined |
| GHSA-6jcq-6546-qrrw PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable | 4.5.110 – < 4.6.61 | Undetermined |
| GHSA-6rmh-7xcm-cpxj PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution | 2.5.6 – < 4.6.34 | Undetermined |
| GHSA-78r8-wwqv-r299 PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334 | < 4.6.40 | Undetermined |
| GHSA-79fv-7hq9-w7xg PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source | < 4.6.78 | Undetermined |
| GHSA-7c92-x8vg-4258 PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents | < 4.6.78 | Undetermined |
| GHSA-7qw2-w5rc-37x2 PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml | 4.5.87 – < 4.6.61 | Undetermined |
| GHSA-7ww9-85pg-cv4x PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution | 4.6.34 – < 4.6.58 | Undetermined |
| GHSA-8444-4fhq-fxpq PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default | < 4.6.40 | Undetermined |
| GHSA-8579-rgg5-ph2m PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals | 4.5.2 – < 4.6.59 | Undetermined |
| GHSA-86qc-r5v2-v6x6 PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset | < 4.6.40 | Undetermined |
| GHSA-892r-p3jq-jp24 PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation | 4.2.1 – < 4.6.59 | Undetermined |
| GHSA-8ccj-p46r-jwqq PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication | < 4.6.61 | Undetermined |
| GHSA-8frj-8q3m-xhgm PraisonAI Vulnerable to Server-Side Request Forgery via Unvalidated webhook_url in Jobs API | < 4.5.128 | Undetermined |
| GHSA-8w9j-hc3g-3g7f PraisonAI Has ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools() | < 4.5.90 | Undetermined |
| GHSA-8x8f-54wf-vv92 PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions | < 4.5.139 | Undetermined |
| GHSA-98f9-fqg5-hvq5 PraisonAI Has Authentication Bypass via OAuthManager.validate_token() | < 4.5.97 | Undetermined |
| GHSA-99g3-w8gr-x37c PraisonAI vulnerable to arbitrary file write via path traversal in `praisonai recipe unpack` | 2.7.2 – < 4.5.128 | Undetermined |
| GHSA-9cq8-3v94-434g PraisonAI Has Second-Order SQL Injection in `get_all_user_threads` | < 4.5.90 | Undetermined |
| GHSA-9cr9-25q5-8prj PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate | < 4.6.40 | Undetermined |
| GHSA-9gm9-c8mq-vq7m PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command() | 4.5.15 – < 4.5.69 | Undetermined |
| GHSA-9mp3-24cc-77mg PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls | < 4.6.78 | Undetermined |
| GHSA-9mqq-jqxf-grvw PraisonAI MCP `tools/call` path-traversal => RCE via Python `.pth` injection | < 4.6.34 | Undetermined |
| GHSA-9q28-ghcr-c4x3 PraisonAI's symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir` | < 4.6.37 | Undetermined |
| GHSA-9qhq-v63v-fv3j PraisonAI has an incomplete fix for CVE-2026-34935 - OS Command Injection | < 4.5.149 | Undetermined |
| GHSA-cfg2-mxfj-j6pw PraisonAI Vulnerable to Stored XSS via Unsanitized Agent Output in HTML Rendering (nh3 Not a Required Dependency) | < 4.5.128 | Undetermined |
| GHSA-cfh6-vr3j-qc3g PraisonAI Has Missing Authentication in WebSocket Gateway | < 4.5.97 | Undetermined |
| GHSA-ch89-h4r2-c8f8 PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks | < 4.6.58 | Undetermined |
| GHSA-cv3g-hj65-pcfh PraisonAI: Shell command allowlist bypass via find -exec built-in action | < 4.6.78 | Undetermined |
| GHSA-f292-66h9-fpmf PraisonAI Has Unauthenticated SSE Event Stream that Exposes All Agent Activity in A2U Server | < 4.5.115 | Undetermined |
| GHSA-f2h6-7xfr-xm8w PraisonAI Vulnerable to Decompression Bomb DoS via Recipe Bundle Extraction Without Size Limits | < 4.5.128 | Undetermined |
| GHSA-f44v-7qgw-9gh9 PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion | 2.6.0 – < 4.6.59 | Undetermined |
| GHSA-fc26-m9pf-v56q PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing | 4.6.56 – < 4.6.59 | Undetermined |
| GHSA-fj8f-m44g-c479 PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats | < 4.6.78 | Undetermined |
| GHSA-fq2m-6wqh-x44g PraisonAI: Jobs API exposes agent-execution endpoints with no authentication | < 4.6.59 | Undetermined |
| GHSA-fvxx-ggmx-3cjg PraisonAI Vulnerable to Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars | < 4.5.128 | Undetermined |
| GHSA-g6j7-pffp-8whg PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation | < 4.6.78 | Undetermined |
| GHSA-g985-wjh9-qxxc PraisonAI Vulnerable to RCE via Automatic tools.py Import | < 4.5.139 | Undetermined |
| GHSA-gcq3-mfvh-3x25 PraisonAI Code agent tools fail open without a workspace boundary | < 4.6.59 | Undetermined |
| GHSA-gfq8-hmph-9gjv PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret | < 4.6.58 | Undetermined |
| GHSA-gmjg-hv98-qggq PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute | < 4.6.37 | Undetermined |
| GHSA-hc5v-gxvj-58wh PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface | < 4.6.78 | Undetermined |
| GHSA-hmfx-4v44-9qw9 PraisonAI vulnerable to Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation | < 4.6.58 | Undetermined |
| GHSA-hvhp-v2gc-268q PraisonAI has an Arbitrary File Write in Python API | < 4.6.40 | Undetermined |
| GHSA-hwg5-x759-7wjg PraisonAI has Template Injection in Agent Tool Definitions | < 4.5.115 | Undetermined |
| GHSA-hxmv-c4g6-5fqc PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code | 3.9.26 – < 4.6.58 | Undetermined |
| GHSA-j4hj-7hfh-g2f4 praisonai: recipe serve auth middleware silently disables itself when no secret is set | < 4.6.59 | Undetermined |
| GHSA-j7qx-p75m-wp7g PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage | 3.8.1 – < 4.6.59 | Undetermined |
| GHSA-jfxc-v5g9-38xr PraisonAI Vulnerable to Arbitrary File Write / Path Traversal in Action Orchestrator | < 4.5.113 | Undetermined |
| GHSA-jxcw-qp4h-6jfq PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default | 4.5.115 – < 4.6.61 | Undetermined |
| GHSA-p4pj-vh7h-6cqh PraisonAI: Unauthenticated Local File Inclusion via agent_file path in PraisonAI Jobs API | < 4.6.59 | Undetermined |
| GHSA-p75f-6fp4-p57w PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai | < 4.6.59 | Undetermined |
| GHSA-pj2r-f9mw-vrcq PraisonAI Vulnerable to Sensitive Environment Variable Exposure via Untrusted MCP Subprocess Execution | < 4.5.128 | Undetermined |
| GHSA-pm96-6xpr-978x PraisonAI: Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOS | < 4.5.128 | Undetermined |
| GHSA-pv9q-275h-rh7x PraisonAI Vulnerable Untrusted Remote Template Code Execution | < 4.5.128 | Undetermined |
| GHSA-pvph-5j39-v8qc PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server | < 4.6.58 | Undetermined |
| GHSA-pvxx-r596-f5qj PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced | < 4.6.58 | Undetermined |
| GHSA-q5r4-47m9-5mc7 PraisonAI: Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate Limits | < 4.5.128 | Undetermined |
| GHSA-q7m5-3jmv-vm48 PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace | < 4.6.78 | Undetermined |
| GHSA-qj9c-59p6-8cgx PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing | < 4.6.78 | Undetermined |
| GHSA-qvpf-j64c-jmhr PraisonAI Slack app_mention bypasses configured user/channel authorization | 3.11.0 – < 4.6.59 | Undetermined |
| GHSA-qwgj-rrpj-75xm PraisonAI: Hardcoded `approval_mode="auto"` in Chainlit UI Overrides Administrator Configuration, Enabling Unapproved Shell Command Execution | < 4.5.128 | Undetermined |
| GHSA-r4f2-3m54-pp7q PraisonAI Has Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandbox | < 4.5.97 | Undetermined |
| GHSA-r7v3-x45f-g7hp PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated | < 4.6.58 | Undetermined |
| GHSA-r9x3-wx45-2v7f PraisonAI recipe registry publish path traversal allows out-of-root file write | < 4.5.113 | Undetermined |
| GHSA-rg3h-x3jw-7jm5 PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315) | < 4.5.149 | Undetermined |
| GHSA-rg5q-pp8p-f7jm PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114 | < 4.6.58 | Undetermined |
| GHSA-rjvw-7vvw-549v PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding | 4.5.126 – < 4.6.59 | Undetermined |
| GHSA-v847-hxxw-3pxg PraisonAI recipe.run_stream skips dangerous-tool policy enforcement | 4.5.87 – < 4.6.59 | Undetermined |
| GHSA-vc46-vw85-3wvm PraisonAI has critical RCE via `type: job` workflow YAML | < 4.5.139 | Undetermined |
| GHSA-vg22-4gmj-prxw PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution | < 4.6.40 | Undetermined |
| GHSA-vmf9-xx9w-86wx PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools | 3.10.0 – < 4.6.59 | Undetermined |
| GHSA-w6h2-fr4q-xvxv PraisonAI: Compute-bridged file tools allow shell command injection | 4.6.10 – < 4.6.59 | Undetermined |
| GHSA-wf65-4jjx-q444 PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL | < 4.6.78 | Undetermined |
| GHSA-wj6g-v78p-6fx3 PraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local MCP server | < 4.6.58 | Undetermined |
| GHSA-wv94-5qcp-6m36 PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced) | < 4.6.58 | Undetermined |
| GHSA-x6m9-gxvr-7jpv PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback | < 4.5.90 | Undetermined |
| GHSA-x783-xp3g-mqhp PraisonAI: SQLiteConversationStore didn't validate table_prefix when constructing SQL queries | < 4.5.133 | Undetermined |
| GHSA-x92v-rpx6-p6cw PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots) | < 4.6.59 | Undetermined |
| GHSA-xcmw-grxf-wjhj PraisonAI has unauthenticated RCE via `tool_override.py` (CVE-2026-40287 patch bypass) | 4.5.139 – < 4.6.32 | Undetermined |
| GHSA-xpx6-x8c2-mw5w PraisonAI: Project custom command templates can read outside-workspace files into model prompts | < 4.6.78 | Undetermined |
| PYSEC-2026-2895 PraisonAI Vulnerable to Implicit Execution of Arbitrary Code via Automatic `tools.py` Loading | < 4.5.128 | Undetermined |
| PYSEC-2026-2896 PraisonAI has Unrestricted Upload Size in WSGI Recipe Registry Server that Enables Memory Exhaustion DoS | < 4.5.128 | Undetermined |
| PYSEC-2026-2897 PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries | 2.4.1 – < 4.6.34 | Undetermined |
| PYSEC-2026-2898 PraisonAI Vulnerable to Code Injection and Protection Mechanism Failure | < 4.5.128 | Undetermined |
| PYSEC-2026-2899 PraisonAI Has Arbitrary File Write (Zip Slip) in Templates Extraction | < 4.5.113 | Undetermined |
| PYSEC-2026-2900 PraisonAI recipe registry pull path traversal writes files outside the chosen output directory | < 4.5.113 | Undetermined |
| PYSEC-2026-2901 PraisonAI: Unauthenticated Allow-List Manipulation Bypasses Agent Tool Approval Safety Controls | < 4.5.128 | Undetermined |
| PYSEC-2026-2902 PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings | < 4.6.40 | Undetermined |
| PYSEC-2026-2903 PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context | < 4.6.40 | Undetermined |
| PYSEC-2026-2904 PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution | 2.5.6 – < 4.6.34 | Undetermined |
| PYSEC-2026-2905 PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334 | < 4.6.40 | Undetermined |
| PYSEC-2026-2906 PraisonAI Vulnerable to Server-Side Request Forgery via Unvalidated webhook_url in Jobs API | < 4.5.128 | Undetermined |
| PYSEC-2026-2907 PraisonAI Has ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools() | < 4.5.90 | Undetermined |
| PYSEC-2026-2908 PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate | < 4.6.40 | Undetermined |
| PYSEC-2026-2909 PraisonAI's symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir` | < 4.6.37 | Undetermined |
| PYSEC-2026-2910 PraisonAI Vulnerable to Stored XSS via Unsanitized Agent Output in HTML Rendering (nh3 Not a Required Dependency) | < 4.5.128 | Undetermined |
| PYSEC-2026-2911 PraisonAI Has Unauthenticated SSE Event Stream that Exposes All Agent Activity in A2U Server | < 4.5.115 | Undetermined |
| PYSEC-2026-2912 PraisonAI Vulnerable to Decompression Bomb DoS via Recipe Bundle Extraction Without Size Limits | < 4.5.128 | Undetermined |
| PYSEC-2026-2913 PraisonAI Vulnerable to Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars | < 4.5.128 | Undetermined |
| PYSEC-2026-2914 PraisonAI Vulnerable to RCE via Automatic tools.py Import | < 4.5.139 | Undetermined |
| PYSEC-2026-2915 PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute | < 4.6.37 | Undetermined |
| PYSEC-2026-2916 PraisonAI has an Arbitrary File Write in Python API | < 4.6.40 | Undetermined |
| PYSEC-2026-2917 PraisonAI has Template Injection in Agent Tool Definitions | < 4.5.115 | Undetermined |
| PYSEC-2026-2918 PraisonAI Vulnerable to Sensitive Environment Variable Exposure via Untrusted MCP Subprocess Execution | < 4.5.128 | Undetermined |
| PYSEC-2026-2919 PraisonAI: Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOS | < 4.5.128 | Undetermined |
| PYSEC-2026-2920 PraisonAI: Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate Limits | < 4.5.128 | Undetermined |
| PYSEC-2026-2921 PraisonAI Has Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandbox | < 4.5.97 | Undetermined |
| PYSEC-2026-2922 PraisonAI recipe registry publish path traversal allows out-of-root file write | < 4.5.113 | Undetermined |
| PYSEC-2026-2923 PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315) | < 4.5.149 | Undetermined |
| PYSEC-2026-2924 PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback | < 4.5.90 | Undetermined |
| PYSEC-2026-2925 PraisonAI: SQLiteConversationStore didn't validate table_prefix when constructing SQL queries | < 4.5.133 | Undetermined |
| PYSEC-2026-2926 PraisonAI has unauthenticated RCE via `tool_override.py` (CVE-2026-40287 patch bypass) | 4.5.139 – < 4.6.32 | Undetermined |
| PYSEC-2026-3499 PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal | 3.8.1 – < 4.6.59 | Undetermined |
| PYSEC-2026-3500 PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation | < 4.6.61 | Undetermined |
| PYSEC-2026-3501 PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass | < 4.6.59 | Undetermined |
| PYSEC-2026-3502 PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard | 4.5.112 – < 4.6.59 | Undetermined |
| PYSEC-2026-3503 PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools | 4.5.2 – < 4.6.59 | Undetermined |
| PYSEC-2026-3504 PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable | 4.5.110 – < 4.6.61 | Undetermined |
| PYSEC-2026-3505 PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml | 4.5.87 – < 4.6.61 | Undetermined |
| PYSEC-2026-3506 PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals | 4.5.2 – < 4.6.59 | Undetermined |
| PYSEC-2026-3507 PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation | 4.2.1 – < 4.6.59 | Undetermined |
| PYSEC-2026-3508 PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication | < 4.6.61 | Undetermined |
| PYSEC-2026-3509 PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion | 2.6.0 – < 4.6.59 | Undetermined |
| PYSEC-2026-3510 PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing | 4.6.56 – < 4.6.59 | Undetermined |
| PYSEC-2026-3511 PraisonAI: Jobs API exposes agent-execution endpoints with no authentication | < 4.6.59 | Undetermined |
| PYSEC-2026-3512 PraisonAI Code agent tools fail open without a workspace boundary | < 4.6.59 | Undetermined |
| PYSEC-2026-3513 praisonai: recipe serve auth middleware silently disables itself when no secret is set | < 4.6.59 | Undetermined |
| PYSEC-2026-3514 PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage | 3.8.1 – < 4.6.59 | Undetermined |
| PYSEC-2026-3515 PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default | 4.5.115 – < 4.6.61 | Undetermined |
| PYSEC-2026-3516 PraisonAI: Unauthenticated Local File Inclusion via agent_file path in PraisonAI Jobs API | < 4.6.59 | Undetermined |
| PYSEC-2026-3517 PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai | < 4.6.59 | Undetermined |
| PYSEC-2026-3518 PraisonAI Slack app_mention bypasses configured user/channel authorization | 3.11.0 – < 4.6.59 | Undetermined |
| PYSEC-2026-3519 PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding | 4.5.126 – < 4.6.59 | Undetermined |
| PYSEC-2026-3520 PraisonAI recipe.run_stream skips dangerous-tool policy enforcement | 4.5.87 – < 4.6.59 | Undetermined |
| PYSEC-2026-3521 PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools | 3.10.0 – < 4.6.59 | Undetermined |
| PYSEC-2026-3522 PraisonAI: Compute-bridged file tools allow shell command injection | 4.6.10 – < 4.6.59 | Undetermined |
| PYSEC-2026-3523 PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots) | < 4.6.59 | Undetermined |
| PYSEC-2026-3885 PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete | < 4.6.58 | Undetermined |
| PYSEC-2026-3886 PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92) | < 4.6.58 | Undetermined |
| PYSEC-2026-3887 PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution | 4.6.34 – < 4.6.58 | Undetermined |
| PYSEC-2026-3888 PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks | < 4.6.58 | Undetermined |
| PYSEC-2026-3889 PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret | < 4.6.58 | Undetermined |
| PYSEC-2026-3890 PraisonAI vulnerable to Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation | < 4.6.58 | Undetermined |
| PYSEC-2026-3891 PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code | 3.9.26 – < 4.6.58 | Undetermined |
| PYSEC-2026-3892 PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server | < 4.6.58 | Undetermined |
| PYSEC-2026-3893 PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced | < 4.6.58 | Undetermined |
| PYSEC-2026-3894 PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated | < 4.6.58 | Undetermined |
| PYSEC-2026-3895 PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114 | < 4.6.58 | Undetermined |
| PYSEC-2026-3896 PraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local MCP server | < 4.6.58 | Undetermined |
| PYSEC-2026-3897 PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced) | < 4.6.58 | Undetermined |
| PYSEC-2026-4247 PraisonAI: Call API localhost-only authentication bypass via spoofed Host header | < 4.6.78 | Undetermined |
| PYSEC-2026-4248 PraisonAI: Prompt-injection defense blocks only when 3+ detector families fire simultaneously; realistic single-vector injections pass through unblocked | < 4.6.78 | Undetermined |
| PYSEC-2026-4249 PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF | < 4.6.78 | Undetermined |
| PYSEC-2026-4250 PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend | < 4.6.78 | Undetermined |
| PYSEC-2026-4251 PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source | < 4.6.78 | Undetermined |
| PYSEC-2026-4252 PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents | < 4.6.78 | Undetermined |
| PYSEC-2026-4253 PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls | < 4.6.78 | Undetermined |
| PYSEC-2026-4254 PraisonAI: Shell command allowlist bypass via find -exec built-in action | < 4.6.78 | Undetermined |
| PYSEC-2026-4255 PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats | < 4.6.78 | Undetermined |
| PYSEC-2026-4256 PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation | < 4.6.78 | Undetermined |
| PYSEC-2026-4257 PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface | < 4.6.78 | Undetermined |
| PYSEC-2026-4258 PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace | < 4.6.78 | Undetermined |
| PYSEC-2026-4259 PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing | < 4.6.78 | Undetermined |
| PYSEC-2026-4260 PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL | < 4.6.78 | Undetermined |
| PYSEC-2026-4261 PraisonAI: Project custom command templates can read outside-workspace files into model prompts | < 4.6.78 | Undetermined |
| PYSEC-2026-461 PraisonAI Vulnerable to OS Command Injection | < 4.5.121 | Undetermined |
| PYSEC-2026-462 PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading | < 4.5.115 | Undetermined |
| PYSEC-2026-463 PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode) | < 4.6.40 | Undetermined |
| PYSEC-2026-464 PraisonAI Has Path Traversal in FileTools | < 1.5.113 | Undetermined |
| PYSEC-2026-465 PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default | < 4.6.40 | Undetermined |
| PYSEC-2026-466 PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset | < 4.6.40 | Undetermined |
| PYSEC-2026-467 PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions | < 4.5.139 | Undetermined |
| PYSEC-2026-468 PraisonAI Has Authentication Bypass via OAuthManager.validate_token() | < 4.5.97 | Undetermined |
| PYSEC-2026-469 PraisonAI vulnerable to arbitrary file write via path traversal in `praisonai recipe unpack` | 2.7.2 – < 4.5.128 | Undetermined |
| PYSEC-2026-470 PraisonAI Has Second-Order SQL Injection in `get_all_user_threads` | < 4.5.90 | Undetermined |
| PYSEC-2026-471 PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command() | 4.5.15 – < 4.5.69 | Undetermined |
| PYSEC-2026-472 PraisonAI MCP `tools/call` path-traversal => RCE via Python `.pth` injection | < 4.6.34 | Undetermined |
| PYSEC-2026-473 PraisonAI has an incomplete fix for CVE-2026-34935 - OS Command Injection | < 4.5.149 | Undetermined |
| PYSEC-2026-474 PraisonAI Has Missing Authentication in WebSocket Gateway | < 4.5.97 | Undetermined |
| PYSEC-2026-475 PraisonAI Vulnerable to Arbitrary File Write / Path Traversal in Action Orchestrator | < 4.5.113 | Undetermined |
| PYSEC-2026-476 PraisonAI Vulnerable Untrusted Remote Template Code Execution | < 4.5.128 | Undetermined |
| PYSEC-2026-477 PraisonAI has critical RCE via `type: job` workflow YAML | < 4.5.139 | Undetermined |
| PYSEC-2026-478 PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution | < 4.6.40 | Undetermined |
Withdrawn advisories (17)
Withdrawn by their publisher: they affect no version and are not counted above.
- GHSA-3wrm-pm5v-8vq8 Duplicate Advisory: PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF · withdrawn
- GHSA-4mp6-8448-9vgv Duplicate Advisory: PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing · withdrawn
- GHSA-5866-9272-qcfv Duplicate Advisory: PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface · withdrawn
- GHSA-5c3v-h6hw-4gx7 Duplicate Advisory: PraisonAI: Prompt-injection defense blocks only when 3+ detector families fire simultaneously; realistic single-vector injections pass through unblocked · withdrawn
- GHSA-5r2q-3wg3-57m2 Duplicate Advisory: PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats · withdrawn
- GHSA-65c8-r727-2mpj Duplicate Advisory: PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend · withdrawn
- GHSA-fwh2-95jw-g4j6 Duplicate Advisory: PraisonAI has Memory State Leakage and Path Traversal in MultiAgent Context Handling · withdrawn
- GHSA-gp65-m7q3-4vjw Duplicate Advisory: PraisonAI: Call API localhost-only authentication bypass via spoofed Host header · withdrawn
- GHSA-m64w-vfg6-36ph Duplicate Advisory: PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents · withdrawn
- GHSA-mhgx-w3w5-2rvc Duplicate Advisory: PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets · withdrawn
- GHSA-q65p-7p84-495c Duplicate Advisory: PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL · withdrawn
- GHSA-qpq9-hwx9-cwgc Duplicate Advisory: PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source · withdrawn
- GHSA-w37c-cq55-frjp Duplicate Advisory: PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace · withdrawn
- GHSA-wgvq-3jxh-4qg7 Duplicate Advisory: PraisonAI: Project custom command templates can read outside-workspace files into model prompts · withdrawn
- GHSA-wj29-gm8v-33x8 Duplicate Advisory: PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls · withdrawn
- GHSA-wrw8-384c-cg76 Duplicate Advisory: PraisonAI: Shell command allowlist bypass via find -exec built-in action · withdrawn
- GHSA-x44p-gg67-52fc Duplicate Advisory: PraisonAI: Coarse-Grained Tool Approval Cache Bypasses Per-Invocation Consent for Shell Commands · withdrawn
Sources
| Source | Licence |
|---|