CVE-2026-55536
CriticalCVSS 9.1Summary
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server _handle_connection() checks Chrome extension origins with re.match() and the unanchored expression chrome-extension://[a-z0-9]{32}. Extra trailing characters pass before websocket.accept(), allowing start_session commands and unauthorized browser automation. This issue is fixed in version 4.6.58.
Risk Assessment
The vulnerability allows unauthorized browser automation, which may lead to user privacy breach, unauthorized actions in the browser, and potential session compromise.
Recommendation
It is recommended to upgrade PraisonAI to version 4.6.58 or later and verify the correctness of Chrome extension origin checks.
Original NVD description (English source)
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server _handle_connection() checks Chrome extension origins with re.match() and the unanchored expression chrome-extension://[a-z0-9]{32}. Extra trailing characters pass before websocket.accept(), allowing start_session commands and unauthorized browser automation. This issue is fixed in version 4.6.58.