Vigie VulnEuropean-hosted Vulnerability DB

praisonai

Page établie d’après les avis qui citent ce paquet : ses métadonnées de registre (versions, licence, dépendances) n’ont pas encore été récupérées par ce service.

En bref

Écosystème
PyPI
État de vulnérabilité
207 avis sans verdict

Avis (207)

AvisVersions affectéesDernière version
GHSA-22cj-m4wf-fv2c
PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal		3.8.1 – < 4.6.59Indéterminé
GHSA-2763-cj5r-c79m
PraisonAI Vulnerable to OS Command Injection		< 4.5.121Indéterminé
GHSA-29w3-p9w9-wc47
PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation		< 4.6.61Indéterminé
GHSA-2g3w-cpc4-chr4
PraisonAI Vulnerable to Implicit Execution of Arbitrary Code via Automatic `tools.py` Loading		< 4.5.128Indéterminé
GHSA-2gpf-2492-q9jh
PraisonAI: Call API localhost-only authentication bypass via spoofed Host header		< 4.6.78Indéterminé
GHSA-2jgc-f764-c5r2
PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete		< 4.6.58Indéterminé
GHSA-2xgv-5cv2-47vv
PraisonAI has Unrestricted Upload Size in WSGI Recipe Registry Server that Enables Memory Exhaustion DoS		< 4.5.128Indéterminé
GHSA-32vr-5gcf-3pw2
PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading		< 4.5.115Indéterminé
GHSA-3643-7v76-5cj2
PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries		2.4.1 – < 4.6.34Indéterminé
GHSA-3c4r-6p77-xwr7
PraisonAI Vulnerable to Code Injection and Protection Mechanism Failure		< 4.5.128Indéterminé
GHSA-4869-x4pr-q22x
PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass		< 4.6.59Indéterminé
GHSA-4mr5-g6f9-cfrh
PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)		< 4.6.40Indéterminé
GHSA-4ph2-f6pf-79wv
PraisonAI Has Arbitrary File Write (Zip Slip) in Templates Extraction		< 4.5.113Indéterminé
GHSA-4r3p-w3mc-5v34
PraisonAI: Prompt-injection defense blocks only when 3+ detector families fire simultaneously; realistic single-vector injections pass through unblocked		< 4.6.78Indéterminé
GHSA-4rx4-4r3x-6534
PraisonAI recipe registry pull path traversal writes files outside the chosen output directory		< 4.5.113Indéterminé
GHSA-4w49-gwv8-fpjg
PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF		< 4.6.78Indéterminé
GHSA-4wr3-f4p3-5wjh
PraisonAI: Unauthenticated Allow-List Manipulation Bypasses Agent Tool Approval Safety Controls		< 4.5.128Indéterminé
GHSA-5c6w-wwfq-7qqm
PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings		< 4.6.40Indéterminé
GHSA-5cxw-77wg-jrf3
PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context		< 4.6.40Indéterminé
GHSA-5qw8-f2g9-ff29
PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard		4.5.112 – < 4.6.59Indéterminé
GHSA-5r6c-gj4g-r697
PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend		< 4.6.78Indéterminé
GHSA-63v4-w882-g4x2
PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools		4.5.2 – < 4.6.59Indéterminé
GHSA-693f-pf34-72c5
PraisonAI Has Path Traversal in FileTools		< 1.5.113Indéterminé
GHSA-6g6r-q6gw-w8fg
PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)		< 4.6.58Indéterminé
GHSA-6jcq-6546-qrrw
PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable		4.5.110 – < 4.6.61Indéterminé
GHSA-6rmh-7xcm-cpxj
PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution		2.5.6 – < 4.6.34Indéterminé
GHSA-78r8-wwqv-r299
PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334		< 4.6.40Indéterminé
GHSA-79fv-7hq9-w7xg
PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source		< 4.6.78Indéterminé
GHSA-7c92-x8vg-4258
PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents		< 4.6.78Indéterminé
GHSA-7qw2-w5rc-37x2
PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml		4.5.87 – < 4.6.61Indéterminé
GHSA-7ww9-85pg-cv4x
PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution		4.6.34 – < 4.6.58Indéterminé
GHSA-8444-4fhq-fxpq
PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default		< 4.6.40Indéterminé
GHSA-8579-rgg5-ph2m
PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals		4.5.2 – < 4.6.59Indéterminé
GHSA-86qc-r5v2-v6x6
PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset		< 4.6.40Indéterminé
GHSA-892r-p3jq-jp24
PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation		4.2.1 – < 4.6.59Indéterminé
GHSA-8ccj-p46r-jwqq
PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication		< 4.6.61Indéterminé
GHSA-8frj-8q3m-xhgm
PraisonAI Vulnerable to Server-Side Request Forgery via Unvalidated webhook_url in Jobs API		< 4.5.128Indéterminé
GHSA-8w9j-hc3g-3g7f
PraisonAI Has ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools()		< 4.5.90Indéterminé
GHSA-8x8f-54wf-vv92
PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions		< 4.5.139Indéterminé
GHSA-98f9-fqg5-hvq5
PraisonAI Has Authentication Bypass via OAuthManager.validate_token()		< 4.5.97Indéterminé
GHSA-99g3-w8gr-x37c
PraisonAI vulnerable to arbitrary file write via path traversal in `praisonai recipe unpack`		2.7.2 – < 4.5.128Indéterminé
GHSA-9cq8-3v94-434g
PraisonAI Has Second-Order SQL Injection in `get_all_user_threads`		< 4.5.90Indéterminé
GHSA-9cr9-25q5-8prj
PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate		< 4.6.40Indéterminé
GHSA-9gm9-c8mq-vq7m
PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()		4.5.15 – < 4.5.69Indéterminé
GHSA-9mp3-24cc-77mg
PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls		< 4.6.78Indéterminé
GHSA-9mqq-jqxf-grvw
PraisonAI MCP `tools/call` path-traversal => RCE via Python `.pth` injection		< 4.6.34Indéterminé
GHSA-9q28-ghcr-c4x3
PraisonAI's symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`		< 4.6.37Indéterminé
GHSA-9qhq-v63v-fv3j
PraisonAI has an incomplete fix for CVE-2026-34935 - OS Command Injection		< 4.5.149Indéterminé
GHSA-cfg2-mxfj-j6pw
PraisonAI Vulnerable to Stored XSS via Unsanitized Agent Output in HTML Rendering (nh3 Not a Required Dependency)		< 4.5.128Indéterminé
GHSA-cfh6-vr3j-qc3g
PraisonAI Has Missing Authentication in WebSocket Gateway		< 4.5.97Indéterminé
GHSA-ch89-h4r2-c8f8
PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks		< 4.6.58Indéterminé
GHSA-cv3g-hj65-pcfh
PraisonAI: Shell command allowlist bypass via find -exec built-in action		< 4.6.78Indéterminé
GHSA-f292-66h9-fpmf
PraisonAI Has Unauthenticated SSE Event Stream that Exposes All Agent Activity in A2U Server		< 4.5.115Indéterminé
GHSA-f2h6-7xfr-xm8w
PraisonAI Vulnerable to Decompression Bomb DoS via Recipe Bundle Extraction Without Size Limits		< 4.5.128Indéterminé
GHSA-f44v-7qgw-9gh9
PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion		2.6.0 – < 4.6.59Indéterminé
GHSA-fc26-m9pf-v56q
PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing		4.6.56 – < 4.6.59Indéterminé
GHSA-fj8f-m44g-c479
PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats		< 4.6.78Indéterminé
GHSA-fq2m-6wqh-x44g
PraisonAI: Jobs API exposes agent-execution endpoints with no authentication		< 4.6.59Indéterminé
GHSA-fvxx-ggmx-3cjg
PraisonAI Vulnerable to Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars		< 4.5.128Indéterminé
GHSA-g6j7-pffp-8whg
PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation		< 4.6.78Indéterminé
GHSA-g985-wjh9-qxxc
PraisonAI Vulnerable to RCE via Automatic tools.py Import		< 4.5.139Indéterminé
GHSA-gcq3-mfvh-3x25
PraisonAI Code agent tools fail open without a workspace boundary		< 4.6.59Indéterminé
GHSA-gfq8-hmph-9gjv
PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret		< 4.6.58Indéterminé
GHSA-gmjg-hv98-qggq
PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute		< 4.6.37Indéterminé
GHSA-hc5v-gxvj-58wh
PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface		< 4.6.78Indéterminé
GHSA-hmfx-4v44-9qw9
PraisonAI vulnerable to Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation		< 4.6.58Indéterminé
GHSA-hvhp-v2gc-268q
PraisonAI has an Arbitrary File Write in Python API		< 4.6.40Indéterminé
GHSA-hwg5-x759-7wjg
PraisonAI has Template Injection in Agent Tool Definitions		< 4.5.115Indéterminé
GHSA-hxmv-c4g6-5fqc
PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code		3.9.26 – < 4.6.58Indéterminé
GHSA-j4hj-7hfh-g2f4
praisonai: recipe serve auth middleware silently disables itself when no secret is set		< 4.6.59Indéterminé
GHSA-j7qx-p75m-wp7g
PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage		3.8.1 – < 4.6.59Indéterminé
GHSA-jfxc-v5g9-38xr
PraisonAI Vulnerable to Arbitrary File Write / Path Traversal in Action Orchestrator		< 4.5.113Indéterminé
GHSA-jxcw-qp4h-6jfq
PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default		4.5.115 – < 4.6.61Indéterminé
GHSA-p4pj-vh7h-6cqh
PraisonAI: Unauthenticated Local File Inclusion via agent_file path in PraisonAI Jobs API		< 4.6.59Indéterminé
GHSA-p75f-6fp4-p57w
PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai		< 4.6.59Indéterminé
GHSA-pj2r-f9mw-vrcq
PraisonAI Vulnerable to Sensitive Environment Variable Exposure via Untrusted MCP Subprocess Execution		< 4.5.128Indéterminé
GHSA-pm96-6xpr-978x
PraisonAI: Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOS		< 4.5.128Indéterminé
GHSA-pv9q-275h-rh7x
PraisonAI Vulnerable Untrusted Remote Template Code Execution		< 4.5.128Indéterminé
GHSA-pvph-5j39-v8qc
PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server		< 4.6.58Indéterminé
GHSA-pvxx-r596-f5qj
PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced		< 4.6.58Indéterminé
GHSA-q5r4-47m9-5mc7
PraisonAI: Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate Limits		< 4.5.128Indéterminé
GHSA-q7m5-3jmv-vm48
PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace		< 4.6.78Indéterminé
GHSA-qj9c-59p6-8cgx
PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing		< 4.6.78Indéterminé
GHSA-qvpf-j64c-jmhr
PraisonAI Slack app_mention bypasses configured user/channel authorization		3.11.0 – < 4.6.59Indéterminé
GHSA-qwgj-rrpj-75xm
PraisonAI: Hardcoded `approval_mode="auto"` in Chainlit UI Overrides Administrator Configuration, Enabling Unapproved Shell Command Execution		< 4.5.128Indéterminé
GHSA-r4f2-3m54-pp7q
PraisonAI Has Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandbox		< 4.5.97Indéterminé
GHSA-r7v3-x45f-g7hp
PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated		< 4.6.58Indéterminé
GHSA-r9x3-wx45-2v7f
PraisonAI recipe registry publish path traversal allows out-of-root file write		< 4.5.113Indéterminé
GHSA-rg3h-x3jw-7jm5
PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)		< 4.5.149Indéterminé
GHSA-rg5q-pp8p-f7jm
PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114		< 4.6.58Indéterminé
GHSA-rjvw-7vvw-549v
PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding		4.5.126 – < 4.6.59Indéterminé
GHSA-v847-hxxw-3pxg
PraisonAI recipe.run_stream skips dangerous-tool policy enforcement		4.5.87 – < 4.6.59Indéterminé
GHSA-vc46-vw85-3wvm
PraisonAI has critical RCE via `type: job` workflow YAML		< 4.5.139Indéterminé
GHSA-vg22-4gmj-prxw
PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution		< 4.6.40Indéterminé
GHSA-vmf9-xx9w-86wx
PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools		3.10.0 – < 4.6.59Indéterminé
GHSA-w6h2-fr4q-xvxv
PraisonAI: Compute-bridged file tools allow shell command injection		4.6.10 – < 4.6.59Indéterminé
GHSA-wf65-4jjx-q444
PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL		< 4.6.78Indéterminé
GHSA-wj6g-v78p-6fx3
PraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local MCP server		< 4.6.58Indéterminé
GHSA-wv94-5qcp-6m36
PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced)		< 4.6.58Indéterminé
GHSA-x6m9-gxvr-7jpv
PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback		< 4.5.90Indéterminé
GHSA-x783-xp3g-mqhp
PraisonAI: SQLiteConversationStore didn't validate table_prefix when constructing SQL queries		< 4.5.133Indéterminé
GHSA-x92v-rpx6-p6cw
PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)		< 4.6.59Indéterminé
GHSA-xcmw-grxf-wjhj
PraisonAI has unauthenticated RCE via `tool_override.py` (CVE-2026-40287 patch bypass)		4.5.139 – < 4.6.32Indéterminé
GHSA-xpx6-x8c2-mw5w
PraisonAI: Project custom command templates can read outside-workspace files into model prompts		< 4.6.78Indéterminé
PYSEC-2026-2895
PraisonAI Vulnerable to Implicit Execution of Arbitrary Code via Automatic `tools.py` Loading		< 4.5.128Indéterminé
PYSEC-2026-2896
PraisonAI has Unrestricted Upload Size in WSGI Recipe Registry Server that Enables Memory Exhaustion DoS		< 4.5.128Indéterminé
PYSEC-2026-2897
PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries		2.4.1 – < 4.6.34Indéterminé
PYSEC-2026-2898
PraisonAI Vulnerable to Code Injection and Protection Mechanism Failure		< 4.5.128Indéterminé
PYSEC-2026-2899
PraisonAI Has Arbitrary File Write (Zip Slip) in Templates Extraction		< 4.5.113Indéterminé
PYSEC-2026-2900
PraisonAI recipe registry pull path traversal writes files outside the chosen output directory		< 4.5.113Indéterminé
PYSEC-2026-2901
PraisonAI: Unauthenticated Allow-List Manipulation Bypasses Agent Tool Approval Safety Controls		< 4.5.128Indéterminé
PYSEC-2026-2902
PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings		< 4.6.40Indéterminé
PYSEC-2026-2903
PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context		< 4.6.40Indéterminé
PYSEC-2026-2904
PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution		2.5.6 – < 4.6.34Indéterminé
PYSEC-2026-2905
PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334		< 4.6.40Indéterminé
PYSEC-2026-2906
PraisonAI Vulnerable to Server-Side Request Forgery via Unvalidated webhook_url in Jobs API		< 4.5.128Indéterminé
PYSEC-2026-2907
PraisonAI Has ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools()		< 4.5.90Indéterminé
PYSEC-2026-2908
PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate		< 4.6.40Indéterminé
PYSEC-2026-2909
PraisonAI's symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`		< 4.6.37Indéterminé
PYSEC-2026-2910
PraisonAI Vulnerable to Stored XSS via Unsanitized Agent Output in HTML Rendering (nh3 Not a Required Dependency)		< 4.5.128Indéterminé
PYSEC-2026-2911
PraisonAI Has Unauthenticated SSE Event Stream that Exposes All Agent Activity in A2U Server		< 4.5.115Indéterminé
PYSEC-2026-2912
PraisonAI Vulnerable to Decompression Bomb DoS via Recipe Bundle Extraction Without Size Limits		< 4.5.128Indéterminé
PYSEC-2026-2913
PraisonAI Vulnerable to Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars		< 4.5.128Indéterminé
PYSEC-2026-2914
PraisonAI Vulnerable to RCE via Automatic tools.py Import		< 4.5.139Indéterminé
PYSEC-2026-2915
PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute		< 4.6.37Indéterminé
PYSEC-2026-2916
PraisonAI has an Arbitrary File Write in Python API		< 4.6.40Indéterminé
PYSEC-2026-2917
PraisonAI has Template Injection in Agent Tool Definitions		< 4.5.115Indéterminé
PYSEC-2026-2918
PraisonAI Vulnerable to Sensitive Environment Variable Exposure via Untrusted MCP Subprocess Execution		< 4.5.128Indéterminé
PYSEC-2026-2919
PraisonAI: Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOS		< 4.5.128Indéterminé
PYSEC-2026-2920
PraisonAI: Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate Limits		< 4.5.128Indéterminé
PYSEC-2026-2921
PraisonAI Has Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandbox		< 4.5.97Indéterminé
PYSEC-2026-2922
PraisonAI recipe registry publish path traversal allows out-of-root file write		< 4.5.113Indéterminé
PYSEC-2026-2923
PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)		< 4.5.149Indéterminé
PYSEC-2026-2924
PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback		< 4.5.90Indéterminé
PYSEC-2026-2925
PraisonAI: SQLiteConversationStore didn't validate table_prefix when constructing SQL queries		< 4.5.133Indéterminé
PYSEC-2026-2926
PraisonAI has unauthenticated RCE via `tool_override.py` (CVE-2026-40287 patch bypass)		4.5.139 – < 4.6.32Indéterminé
PYSEC-2026-3499
PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal		3.8.1 – < 4.6.59Indéterminé
PYSEC-2026-3500
PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation		< 4.6.61Indéterminé
PYSEC-2026-3501
PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass		< 4.6.59Indéterminé
PYSEC-2026-3502
PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard		4.5.112 – < 4.6.59Indéterminé
PYSEC-2026-3503
PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools		4.5.2 – < 4.6.59Indéterminé
PYSEC-2026-3504
PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable		4.5.110 – < 4.6.61Indéterminé
PYSEC-2026-3505
PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml		4.5.87 – < 4.6.61Indéterminé
PYSEC-2026-3506
PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals		4.5.2 – < 4.6.59Indéterminé
PYSEC-2026-3507
PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation		4.2.1 – < 4.6.59Indéterminé
PYSEC-2026-3508
PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication		< 4.6.61Indéterminé
PYSEC-2026-3509
PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion		2.6.0 – < 4.6.59Indéterminé
PYSEC-2026-3510
PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing		4.6.56 – < 4.6.59Indéterminé
PYSEC-2026-3511
PraisonAI: Jobs API exposes agent-execution endpoints with no authentication		< 4.6.59Indéterminé
PYSEC-2026-3512
PraisonAI Code agent tools fail open without a workspace boundary		< 4.6.59Indéterminé
PYSEC-2026-3513
praisonai: recipe serve auth middleware silently disables itself when no secret is set		< 4.6.59Indéterminé
PYSEC-2026-3514
PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage		3.8.1 – < 4.6.59Indéterminé
PYSEC-2026-3515
PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default		4.5.115 – < 4.6.61Indéterminé
PYSEC-2026-3516
PraisonAI: Unauthenticated Local File Inclusion via agent_file path in PraisonAI Jobs API		< 4.6.59Indéterminé
PYSEC-2026-3517
PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai		< 4.6.59Indéterminé
PYSEC-2026-3518
PraisonAI Slack app_mention bypasses configured user/channel authorization		3.11.0 – < 4.6.59Indéterminé
PYSEC-2026-3519
PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding		4.5.126 – < 4.6.59Indéterminé
PYSEC-2026-3520
PraisonAI recipe.run_stream skips dangerous-tool policy enforcement		4.5.87 – < 4.6.59Indéterminé
PYSEC-2026-3521
PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools		3.10.0 – < 4.6.59Indéterminé
PYSEC-2026-3522
PraisonAI: Compute-bridged file tools allow shell command injection		4.6.10 – < 4.6.59Indéterminé
PYSEC-2026-3523
PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)		< 4.6.59Indéterminé
PYSEC-2026-3885
PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete		< 4.6.58Indéterminé
PYSEC-2026-3886
PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)		< 4.6.58Indéterminé
PYSEC-2026-3887
PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution		4.6.34 – < 4.6.58Indéterminé
PYSEC-2026-3888
PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks		< 4.6.58Indéterminé
PYSEC-2026-3889
PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret		< 4.6.58Indéterminé
PYSEC-2026-3890
PraisonAI vulnerable to Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation		< 4.6.58Indéterminé
PYSEC-2026-3891
PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code		3.9.26 – < 4.6.58Indéterminé
PYSEC-2026-3892
PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server		< 4.6.58Indéterminé
PYSEC-2026-3893
PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced		< 4.6.58Indéterminé
PYSEC-2026-3894
PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated		< 4.6.58Indéterminé
PYSEC-2026-3895
PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114		< 4.6.58Indéterminé
PYSEC-2026-3896
PraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local MCP server		< 4.6.58Indéterminé
PYSEC-2026-3897
PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced)		< 4.6.58Indéterminé
PYSEC-2026-4247
PraisonAI: Call API localhost-only authentication bypass via spoofed Host header		< 4.6.78Indéterminé
PYSEC-2026-4248
PraisonAI: Prompt-injection defense blocks only when 3+ detector families fire simultaneously; realistic single-vector injections pass through unblocked		< 4.6.78Indéterminé
PYSEC-2026-4249
PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF		< 4.6.78Indéterminé
PYSEC-2026-4250
PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend		< 4.6.78Indéterminé
PYSEC-2026-4251
PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source		< 4.6.78Indéterminé
PYSEC-2026-4252
PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents		< 4.6.78Indéterminé
PYSEC-2026-4253
PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls		< 4.6.78Indéterminé
PYSEC-2026-4254
PraisonAI: Shell command allowlist bypass via find -exec built-in action		< 4.6.78Indéterminé
PYSEC-2026-4255
PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats		< 4.6.78Indéterminé
PYSEC-2026-4256
PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation		< 4.6.78Indéterminé
PYSEC-2026-4257
PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface		< 4.6.78Indéterminé
PYSEC-2026-4258
PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace		< 4.6.78Indéterminé
PYSEC-2026-4259
PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing		< 4.6.78Indéterminé
PYSEC-2026-4260
PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL		< 4.6.78Indéterminé
PYSEC-2026-4261
PraisonAI: Project custom command templates can read outside-workspace files into model prompts		< 4.6.78Indéterminé
PYSEC-2026-461
PraisonAI Vulnerable to OS Command Injection		< 4.5.121Indéterminé
PYSEC-2026-462
PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading		< 4.5.115Indéterminé
PYSEC-2026-463
PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)		< 4.6.40Indéterminé
PYSEC-2026-464
PraisonAI Has Path Traversal in FileTools		< 1.5.113Indéterminé
PYSEC-2026-465
PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default		< 4.6.40Indéterminé
PYSEC-2026-466
PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset		< 4.6.40Indéterminé
PYSEC-2026-467
PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions		< 4.5.139Indéterminé
PYSEC-2026-468
PraisonAI Has Authentication Bypass via OAuthManager.validate_token()		< 4.5.97Indéterminé
PYSEC-2026-469
PraisonAI vulnerable to arbitrary file write via path traversal in `praisonai recipe unpack`		2.7.2 – < 4.5.128Indéterminé
PYSEC-2026-470
PraisonAI Has Second-Order SQL Injection in `get_all_user_threads`		< 4.5.90Indéterminé
PYSEC-2026-471
PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()		4.5.15 – < 4.5.69Indéterminé
PYSEC-2026-472
PraisonAI MCP `tools/call` path-traversal => RCE via Python `.pth` injection		< 4.6.34Indéterminé
PYSEC-2026-473
PraisonAI has an incomplete fix for CVE-2026-34935 - OS Command Injection		< 4.5.149Indéterminé
PYSEC-2026-474
PraisonAI Has Missing Authentication in WebSocket Gateway		< 4.5.97Indéterminé
PYSEC-2026-475
PraisonAI Vulnerable to Arbitrary File Write / Path Traversal in Action Orchestrator		< 4.5.113Indéterminé
PYSEC-2026-476
PraisonAI Vulnerable Untrusted Remote Template Code Execution		< 4.5.128Indéterminé
PYSEC-2026-477
PraisonAI has critical RCE via `type: job` workflow YAML		< 4.5.139Indéterminé
PYSEC-2026-478
PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution		< 4.6.40Indéterminé

Avis retirés (17)

Retirés par leur éditeur : ils ne concernent aucune version et ne sont pas comptés ci-dessus.

Sources

SourceLicence