praisonaiagents
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- PyPI
- Vulnerability status
- 99 advisory(ies) without a verdict
Advisories (99)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-29r9-67vg-qj56 PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments | < 1.6.78 | Undetermined |
| GHSA-2rcg-mm5h-xchx PraisonAI: Arbitrary File Read via `@file:` Mention Path Traversal | < 1.6.59 | Undetermined |
| GHSA-2xv2-w8cq-5gxw PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets | < 1.6.78 | Undetermined |
| GHSA-35w5-pcw4-jx94 PraisonAI: Unauthenticated Event Injection via SSE `/publish` Endpoint | < 1.6.59 | Undetermined |
| GHSA-44c2-3rw4-5gvh PraisonAI Has SSRF in FileTools.download_file() via Unvalidated URL | < 1.5.95 | Undetermined |
| GHSA-4869-x4pr-q22x PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass | < 1.6.59 | Undetermined |
| GHSA-4gfv-wg42-7jw5 PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow | < 1.6.78 | Undetermined |
| GHSA-4mr5-g6f9-cfrh PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode) | < 1.6.40 | Undetermined |
| GHSA-4pcv-mg8v-vrgf PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter | < 1.6.61 | Undetermined |
| GHSA-4xxv-6wmf-xf45 PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace | < 1.6.78 | Undetermined |
| GHSA-5c6w-wwfq-7qqm PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings | < 1.6.40 | Undetermined |
| GHSA-5cxw-77wg-jrf3 PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context | < 1.6.40 | Undetermined |
| GHSA-5r34-2g38-6569 praisonaiagents web_crawl vulnerable to SSRF via redirect-following | < 1.6.58 | Undetermined |
| GHSA-6g59-gm2v-qhvq PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass | < 1.6.78 | Undetermined |
| GHSA-6h9p-93hq-q7h6 PraisonAI: SpiderTools redirect-target SSRF protection bypass | < 1.6.59 | Undetermined |
| GHSA-6vh2-h83c-9294 PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code | < 1.5.90 | Undetermined |
| GHSA-766v-q9x3-g744 PraisonAI has Memory State Leakage and Path Traversal in MultiAgent Context Handling | < 1.5.115 | Undetermined |
| GHSA-7g3p-92qq-8wvh praisonaiagents: AgentServer declares auth_token but never enforces it on any route | < 1.6.58 | Undetermined |
| GHSA-7j2f-xc8p-fjmq PraisonAIAgents: Path Traversal via Unvalidated Glob Pattern in list_files Bypasses Workspace Boundary | < 1.5.128 | Undetermined |
| GHSA-8f4v-xfm9-3244 PraisonAIAgents has SSRF and Local File Read via Unvalidated URLs in web_crawl Tool | < 1.5.128 | Undetermined |
| GHSA-8hjw-25cg-g52h praisonaiagents has a `web_crawl` SSRF protection bypass via unchecked redirect targets | 1.5.128 – < 1.6.58 | Undetermined |
| GHSA-8x8f-54wf-vv92 PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions | < 1.5.140 | Undetermined |
| GHSA-c44f-37qr-gw3f PraisonAI: SkillTools Executes Scripts Without Path Containment Validation | < 1.6.78 | Undetermined |
| GHSA-c969-5x3p-vq3v PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters | < 1.6.59 | Undetermined |
| GHSA-cfxv-8fw8-rwpv praisonaiagents: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool | < 1.6.58 | Undetermined |
| GHSA-ffp3-3562-8cv3 PraisonAI: Coarse-Grained Tool Approval Cache Bypasses Per-Invocation Consent for Shell Commands | < 4.5.128 | Undetermined |
| GHSA-g985-wjh9-qxxc PraisonAI Vulnerable to RCE via Automatic tools.py Import | < 1.5.140 | Undetermined |
| GHSA-gmjg-hv98-qggq PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute | < 1.6.37 | Undetermined |
| GHSA-grrg-5cg9-58pf PraisonAIAgents: Arbitrary File Read via read_skill_file Missing Workspace Boundary and Approval Gate | < 1.5.128 | Undetermined |
| GHSA-gxmw-5f7x-6g22 praisonaiagents vulnerable to arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location | < 1.6.58 | Undetermined |
| GHSA-hxmv-c4g6-5fqc PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code | 0.12.12 – < 1.6.58 | Undetermined |
| GHSA-m6wp-h223-4c8g PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification | < 1.6.78 | Undetermined |
| GHSA-pv2j-rghr-v5r9 PraisonAI: execute_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunder | < 1.6.59 | Undetermined |
| GHSA-q9pw-vmhh-384g PraisonAI has an SSRF bypass | < 1.6.32 | Undetermined |
| GHSA-qf73-2hrx-xprp PraisonAI has sandbox escape via exception frame traversal in `execute_code` (subprocess mode) | < 1.5.115 | Undetermined |
| GHSA-qg25-6gc4-48mg PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure | < 1.6.78 | Undetermined |
| GHSA-qjw5-xwrp-xwpq PraisonAI: Project config can auto-save agent output outside the project root | < 1.6.78 | Undetermined |
| GHSA-qq9r-63f6-v542 PraisonAIAgents: SSRF via unvalidated URL in `web_crawl` httpx fallback | 0.13.23 – < 1.5.128 | Undetermined |
| GHSA-rg3h-x3jw-7jm5 PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315) | < 1.6.8 | Undetermined |
| GHSA-v7px-3835-7gjx PraisonAIAgents has an OS Command Injection via shell=True in Memory Hooks Executor (memory/hooks.py) | < 1.5.128 | Undetermined |
| GHSA-v8g7-9q6v-p3x8 PraisonAIAgents: Environment Variable Secret Exfiltration via os.path.expandvars() Bypassing shell=False in Shell Tool | < 1.5.128 | Undetermined |
| GHSA-vc46-vw85-3wvm PraisonAI has critical RCE via `type: job` workflow YAML | < 1.5.140 | Undetermined |
| GHSA-vg6p-v9vm-6fgj praisonaiagents vulnerable to SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap) | < 1.6.58 | Undetermined |
| GHSA-vmf9-xx9w-86wx PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools | 0.6.0 – < 1.6.59 | Undetermined |
| GHSA-vxgj-xg5c-p4h7 praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS | < 1.6.59 | Undetermined |
| GHSA-w37c-qqfp-c67f PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution | < 1.5.90 | Undetermined |
| GHSA-x227-pf99-vffg PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in | < 1.6.59 | Undetermined |
| GHSA-x44h-65qv-cw74 praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`) | < 1.6.58 | Undetermined |
| GHSA-x462-jjpc-q4q4 PraisonAI: Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI Endpoint | < 4.5.128 | Undetermined |
| GHSA-x8cv-xmq7-p8xp PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints | < 1.6.59 | Undetermined |
| PYSEC-2026-2940 PraisonAI Has SSRF in FileTools.download_file() via Unvalidated URL | < 1.5.95 | Undetermined |
| PYSEC-2026-2941 PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings | < 1.6.40 | Undetermined |
| PYSEC-2026-2942 PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context | < 1.6.40 | Undetermined |
| PYSEC-2026-2943 PraisonAI has Memory State Leakage and Path Traversal in MultiAgent Context Handling | < 1.5.115 | Undetermined |
| PYSEC-2026-2944 PraisonAIAgents: Path Traversal via Unvalidated Glob Pattern in list_files Bypasses Workspace Boundary | < 1.5.128 | Undetermined |
| PYSEC-2026-2945 PraisonAIAgents has SSRF and Local File Read via Unvalidated URLs in web_crawl Tool | < 1.5.128 | Undetermined |
| PYSEC-2026-2946 PraisonAI: Coarse-Grained Tool Approval Cache Bypasses Per-Invocation Consent for Shell Commands | < 4.5.128 | Undetermined |
| PYSEC-2026-2947 PraisonAI Vulnerable to RCE via Automatic tools.py Import | < 1.5.140 | Undetermined |
| PYSEC-2026-2948 PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute | < 1.6.37 | Undetermined |
| PYSEC-2026-2949 PraisonAIAgents: Arbitrary File Read via read_skill_file Missing Workspace Boundary and Approval Gate | < 1.5.128 | Undetermined |
| PYSEC-2026-2950 PraisonAI has an SSRF bypass | < 1.6.32 | Undetermined |
| PYSEC-2026-2951 PraisonAIAgents: SSRF via unvalidated URL in `web_crawl` httpx fallback | 0.13.23 – < 1.5.128 | Undetermined |
| PYSEC-2026-2952 PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315) | < 1.6.8 | Undetermined |
| PYSEC-2026-2953 PraisonAIAgents: Environment Variable Secret Exfiltration via os.path.expandvars() Bypassing shell=False in Shell Tool | < 1.5.128 | Undetermined |
| PYSEC-2026-2954 PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution | < 1.5.90 | Undetermined |
| PYSEC-2026-3527 PraisonAI: Arbitrary File Read via `@file:` Mention Path Traversal | < 1.6.59 | Undetermined |
| PYSEC-2026-3528 PraisonAI: Unauthenticated Event Injection via SSE `/publish` Endpoint | < 1.6.59 | Undetermined |
| PYSEC-2026-3529 PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass | < 1.6.59 | Undetermined |
| PYSEC-2026-3530 PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter | < 1.6.61 | Undetermined |
| PYSEC-2026-3531 PraisonAI: SpiderTools redirect-target SSRF protection bypass | < 1.6.59 | Undetermined |
| PYSEC-2026-3532 PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters | < 1.6.59 | Undetermined |
| PYSEC-2026-3533 PraisonAI: execute_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunder | < 1.6.59 | Undetermined |
| PYSEC-2026-3534 PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools | 0.6.0 – < 1.6.59 | Undetermined |
| PYSEC-2026-3535 praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS | < 1.6.59 | Undetermined |
| PYSEC-2026-3536 PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in | < 1.6.59 | Undetermined |
| PYSEC-2026-3537 PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints | < 1.6.59 | Undetermined |
| PYSEC-2026-3898 praisonaiagents web_crawl vulnerable to SSRF via redirect-following | < 1.6.58 | Undetermined |
| PYSEC-2026-3899 praisonaiagents: AgentServer declares auth_token but never enforces it on any route | < 1.6.58 | Undetermined |
| PYSEC-2026-3900 praisonaiagents has a `web_crawl` SSRF protection bypass via unchecked redirect targets | 1.5.128 – < 1.6.58 | Undetermined |
| PYSEC-2026-3901 praisonaiagents: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool | < 1.6.58 | Undetermined |
| PYSEC-2026-3902 praisonaiagents vulnerable to arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location | < 1.6.58 | Undetermined |
| PYSEC-2026-3903 PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code | 0.12.12 – < 1.6.58 | Undetermined |
| PYSEC-2026-3904 praisonaiagents vulnerable to SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap) | < 1.6.58 | Undetermined |
| PYSEC-2026-3905 praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`) | < 1.6.58 | Undetermined |
| PYSEC-2026-4265 PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments | < 1.6.78 | Undetermined |
| PYSEC-2026-4266 PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets | < 1.6.78 | Undetermined |
| PYSEC-2026-4267 PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow | < 1.6.78 | Undetermined |
| PYSEC-2026-4268 PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace | < 1.6.78 | Undetermined |
| PYSEC-2026-4269 PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass | < 1.6.78 | Undetermined |
| PYSEC-2026-4270 PraisonAI: SkillTools Executes Scripts Without Path Containment Validation | < 1.6.78 | Undetermined |
| PYSEC-2026-4271 PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification | < 1.6.78 | Undetermined |
| PYSEC-2026-4272 PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure | < 1.6.78 | Undetermined |
| PYSEC-2026-4273 PraisonAI: Project config can auto-save agent output outside the project root | < 1.6.78 | Undetermined |
| PYSEC-2026-483 PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode) | < 1.6.40 | Undetermined |
| PYSEC-2026-484 PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code | < 1.5.90 | Undetermined |
| PYSEC-2026-485 PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions | < 1.5.140 | Undetermined |
| PYSEC-2026-486 PraisonAI has sandbox escape via exception frame traversal in `execute_code` (subprocess mode) | < 1.5.115 | Undetermined |
| PYSEC-2026-487 PraisonAIAgents has an OS Command Injection via shell=True in Memory Hooks Executor (memory/hooks.py) | < 1.5.128 | Undetermined |
| PYSEC-2026-488 PraisonAI has critical RCE via `type: job` workflow YAML | < 1.5.140 | Undetermined |
Withdrawn advisories (8)
Withdrawn by their publisher: they affect no version and are not counted above.
- GHSA-3f4v-mp44-x4x2 Duplicate Advisory: PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace · withdrawn
- GHSA-92x2-g374-gcvx Duplicate Advisory: PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure · withdrawn
- GHSA-c6pq-cprj-62fw Duplicate Advisory: PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow · withdrawn
- GHSA-f352-4x87-wmjh Duplicate Advisory: PraisonAI: SkillTools Executes Scripts Without Path Containment Validation · withdrawn
- GHSA-q359-rmv4-56fg Duplicate Advisory: PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification · withdrawn
- GHSA-r3xw-gcpr-rf26 Duplicate Advisory: PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments · withdrawn
- GHSA-rc3q-9pxg-3jhr Duplicate Advisory: PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass · withdrawn
- GHSA-rrqj-82cc-g6h4 Duplicate Advisory: PraisonAI: Project config can auto-save agent output outside the project root · withdrawn
Sources
| Source | Licence |
|---|