CVE-2026-57118

In PraisonAI before praisonaiagents 1.6.62, searxng_search and the search_web SearxNG provider pass the LLM-controlled searxng_url parameter directly to requests.get without validating scheme, host, port, or resolved address. Prompt-injected content can direct the search tool to internal JSON services, distinguish open and closed internal ports, and attempt cloud-metadata requests.

A vulnerability in PraisonAI before version 4.6.78 allows bypassing the shell command allowlist by using find's built-in actions (-exec, -execdir, -delete). Attackers can execute unauthorized commands, read or delete files without triggering shell metacharacter filters.

A path traversal vulnerability in PraisonAI (praisonaiagents) before version 1.6.78 in the FastContext feature. The FastContextAgent.execute_tool() function does not properly validate absolute paths or canonicalize relative paths, allowing reading, searching, and enumerating files outside the intended workspace directory.

PraisonAI before version 4.6.78 contains a path traversal vulnerability in the ContextGatherer component that fails to validate include paths in .praisoncontext and .praisoninclude files. Attackers can supply absolute paths or parent directory traversal sequences to read arbitrary files outside the workspace and include their contents in the generated context bundle.

PraisonAI before version 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the Jobs API /api/v1/runs endpoint. The webhook_url parameter is validated at request time but re-resolved at connection time, allowing attackers to use DNS rebinding to reach internal services with a blind SSRF attack.

A vulnerability in PraisonAI (praisonaiagents) before version 1.6.78 automatically loads defaults from a project-local .praisonai/config.toml without validating the output.output_file path. An attacker can set this path to an absolute or '..' traversal path, causing agent.start() without an output parameter to overwrite files outside the project root.

In the multi-agent system PraisonAI prior to version 4.6.37, a vulnerability allows the exploitation of symlinks to write arbitrary data to a chosen location on the victim's filesystem. The issue stems from the lack of validation for member.linkname and not rejecting symlink/hardlink members.

In the multi-agent system PraisonAI, versions from 4.5.139 to before 4.6.32 have a vulnerability related to unauthorized file imports. The tool_override.py file lacks safeguards, allowing remote code execution by an attacker.

PraisonAI prior to version 4.6.78 has a vulnerability in the `deploy/api.py` module that generates Python server code by directly interpolating the `agents_file` parameter into an f-string, which is then written to a file and executed via `subprocess.Popen()`. An attacker who controls the `agents_file` value can inject arbitrary Python code.

In PraisonAI prior to 0.1.6, when PLATFORM_JWT_SECRET is unset, the public dev-secret-change-me HS256 signing key is used, and startup and token-issuance guards are disabled because PLATFORM_ENV defaults to dev. An unauthenticated attacker can sign a JWT with an arbitrary sub value that is accepted as an authenticated identity, enabling impersonation of a user or workspace owner.