PraisonAI vulnerabilities

PraisonAI before version 4.6.58 has a flaw in create_auth_middleware() that allows requests when auth=api-key lacks PRAISONAI_API_KEY or JWT authentication lacks PRAISONAI_JWT_SECRET. An externally bound Recipe server can accept unauthenticated POST /v1/recipes/run requests despite authentication being enabled.

PraisonAI before version 4.6.58 has a flaw in MCP HTTP Stream _validate_origin that uses startswith, allowing attacker-controlled localhost.attacker.com origin to pass the allowlist. A webpage can send text/plain requests without preflight and invoke tools without an API key, including file writes.

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, _create_agents_app() does not authenticate POST /agents or POST /agents/{agent_name}. Missing or incorrect bearer and X-API-Key values still reach agent execution. This issue is fixed in version 4.6.58.

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, JobSubmitRequest.validate_webhook_url() accepts webhook_url when resolution raises socket.gaierror because the exception path uses except socket.gaierror: pass. JobExecutor._send_webhook() later performs a fresh lookup, allowing DNS changes to direct the request to an internal service. This issue is fixed in version 4.6.58.

PraisonAI before version 4.6.58 has a vulnerability in the MCP HTTP Stream handler where the mcp_post handler creates a new _sessions entry for every initialize request but does not call _cleanup_sessions or enforce a maximum. An unauthenticated attacker can exhaust memory.

PraisonAI before version 1.6.58 has a vulnerability in the ast_grep_rewrite function, which lacks the @require_approval decorator used by sibling mutation tools. With dry_run=False, an agent-controlled call can pass --update-all and a broad path to rewrite matching files without the expected authorization gate.

PraisonAI is a multi-agent system. Prior to praisonaiagents 1.6.58, the web_crawl function validates only the initial URL before _crawl_with_httpx uses httpx.Client(follow_redirects=True). Redirect targets are not revalidated, so an attacker who influences a crawl target can redirect a public URL to loopback, private network, or cloud metadata services while ALLOW_LOCAL_CRAWL remains disabled. The fetched internal response is returned to the agent context. This issue is fixed in version 1.6.58.

A vulnerability in PraisonAI before version 4.6.78 allows bypassing the shell command allowlist by using find's built-in actions (-exec, -execdir, -delete). Attackers can execute unauthorized commands, read or delete files without triggering shell metacharacter filters.

A path traversal vulnerability in PraisonAI (praisonaiagents) before version 1.6.78 in the FastContext feature. The FastContextAgent.execute_tool() function does not properly validate absolute paths or canonicalize relative paths, allowing reading, searching, and enumerating files outside the intended workspace directory.

PraisonAI before version 4.6.78 contains a path traversal vulnerability in the ContextGatherer component that fails to validate include paths in .praisoncontext and .praisoninclude files. Attackers can supply absolute paths or parent directory traversal sequences to read arbitrary files outside the workspace and include their contents in the generated context bundle.

PraisonAI before version 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the Jobs API /api/v1/runs endpoint. The webhook_url parameter is validated at request time but re-resolved at connection time, allowing attackers to use DNS rebinding to reach internal services with a blind SSRF attack.

A vulnerability in PraisonAI (praisonaiagents) before version 1.6.78 automatically loads defaults from a project-local .praisonai/config.toml without validating the output.output_file path. An attacker can set this path to an absolute or '..' traversal path, causing agent.start() without an output parameter to overwrite files outside the project root.

In the multi-agent system PraisonAI prior to version 4.6.37, a vulnerability allows the exploitation of symlinks to write arbitrary data to a chosen location on the victim's filesystem. The issue stems from the lack of validation for member.linkname and not rejecting symlink/hardlink members.

In the multi-agent system PraisonAI, versions from 4.5.139 to before 4.6.32 have a vulnerability related to unauthorized file imports. The tool_override.py file lacks safeguards, allowing remote code execution by an attacker.

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server _handle_connection() checks Chrome extension origins with re.match() and the unanchored expression chrome-extension://[a-z0-9]{32}. Extra trailing characters pass before websocket.accept(), allowing start_session commands and unauthorized browser automation. This issue is fixed in version 4.6.58.

PraisonAI before 4.6.40 contains a command injection vulnerability in the bundled Claude GitHub Actions workflow. The pull request branch name is embedded in a Bash block without validation, and any @claude comment can trigger the job, allowing outside contributors to execute arbitrary code in the runner.

PraisonAI prior to version 4.6.40 exposes an unauthenticated agent control API when CALL_SERVER_TOKEN is not set. The verify_token() helper fails open, and the call server binds to 0.0.0.0 by default, allowing any client to list, inspect, invoke, and unregister agents.

PraisonAI by default generates a Flask API server without authentication, listening on all network interfaces (0.0.0.0) and exposing sensitive endpoints. An attacker can send requests to /chat and /agents endpoints without any authentication, allowing execution of LLM code with API keys present in the environment.

In PraisonAI before version 4.6.40 (corresponding to praisonaiagents version 1.6.40), a vulnerability exists in the `execute_code()` function in `praisonaiagents/tools/python_tools.py`. An attacker can bypass the subprocess sandbox by using `print.__self__` to access the real Python `builtins` module, then extract `__import__` via `vars()` and runtime string construction, achieving arbitrary OS command execution on the host.

PraisonAI before version 4.6.40 includes an example A2A server that exposes an unauthenticated A2A JSON-RPC endpoint and registers a calculate(expression) tool implemented with Python eval(). The server binds to 0.0.0.0. A remote unauthenticated attacker can send message/send to /a2a, causing the LLM to invoke the calculate tool, leading to arbitrary Python execution on the server. The vulnerability affects deployments following the official A2A example or similar unauthenticated A2A deployments with unsafe tools.

PraisonAI before version 1.6.78 contains a remote code execution vulnerability in the CodeAgent._execute_python() function, which executes LLM-generated Python code without AST validation, import restrictions, or sandbox enforcement. Attackers can influence LLM output through prompt injection to exfiltrate all environment secrets and execute arbitrary code on the host system.

PraisonAI before version 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component. Missing path validation and command sanitization in LLM tool calls allow attackers to inject malicious prompts through the chat interface.

A vulnerability in PraisonAI before version 4.6.78 allows SQL/CQL injection due to improper validation of the dimension argument in PGVector and Cassandra backends. An attacker can pass a malicious string that is directly interpolated into the CREATE TABLE query, potentially leading to unauthorized database operations.

PraisonAI before version 4.6.78 contains a code injection vulnerability in deploy/api.py where the agents_file parameter is directly interpolated into an f-string without sanitization. Attackers can inject arbitrary Python code that executes when the generated server code runs via subprocess.Popen().

PraisonAI is a multi-agent teams system. Prior to version 1.6.32, the URL checking logic in PraisonAI had a logical flaw that could be bypassed by attackers, leading to SSRF attacks.

PraisonAI prior to 4.5.115 has a vulnerability in the AgentService.loadAgentFromFile method that uses the js-yaml library to parse YAML files without disabling dangerous tags (such as !!js/function and !!js/undefined). This allows an attacker to craft a malicious YAML file that, when parsed, executes arbitrary JavaScript code.

PraisonAI prior to version 1.5.115 has a vulnerability in the execute_code() function in sandbox mode. The AST blocklist in the subprocess is incomplete, allowing sandbox escape and arbitrary Python code execution.

PraisonAI prior to version 4.5.97 has a vulnerability in OAuthManager.validate_token() that returns True for any token not found in its internal store (empty by default). Any HTTP request to the MCP server with an arbitrary Bearer token is treated as authenticated, granting full access to all registered tools and agent capabilities.

PraisonAI is a multi-agent teams system. Prior to version 4.5.97, the PraisonAI Gateway server accepts WebSocket connections at /ws and serves agent topology at /info with no authentication. Any network client can connect, enumerate registered agents, and send arbitrary messages to agents and their tool sets.

PraisonAI prior to version 1.5.90 has a vulnerability in execute_code() that allows bypassing a three-layer sandbox by passing a str subclass with an overridden startswith() method, leading to arbitrary OS command execution.

PraisonAI versions 4.5.15 through 4.5.69 contain a vulnerability allowing arbitrary OS command execution via the --mcp CLI argument, which is passed without validation to shlex.split() and anyio.open_process(). An attacker can exploit this to execute arbitrary commands in the process user context.

PraisonAI is a multi-agent system. Prior to version 4.5.90, the get_all_user_threads function constructs raw SQL queries using f-strings with unescaped thread IDs from the database. An attacker stores a malicious thread ID via update_thread, and when the thread list is loaded, the injected SQL executes, granting full database access.

PraisonAI before version 4.6.51 exposes the /api/v1/runs endpoint without authentication. Any reachable caller can submit jobs, read results, cancel runs, or delete jobs using operator credentials. The fix adds PRAISONAI_JOBS_API_KEY middleware.

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, _create_agents_app() and _create_unified_app() do not install a credential check, allowing unauthenticated callers to reach POST /agents and POST /api/v1/agents/{id}/invoke. This issue is fixed in version 4.6.58.

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, is_path_within_directory() uses os.path.abspath() rather than os.path.realpath() for the workspace boundary. A symlink inside workspace can point outside and still pass the check, allowing read_file and other code tools to access files outside the configured workspace. This issue is fixed in version 4.6.58.

PraisonAI before version 4.6.58 has a vulnerability in the Jobs API where the validate_webhook_url() path fails open on socket.gaierror and does not bind the validated address to the later request. An attacker can supply a webhook_url that later resolves to 127.0.0.1, 169.254.169.254, or another internal address.

PraisonAI is a multi-agent teams system. From praisonai 4.6.34 until 4.6.58, _create_agents_app() does not authenticate POST /agents or POST /agents/{agent_name}. A network caller can invoke configured agents without credentials even when an API key was supplied. This issue is fixed in version 4.6.58.

PraisonAI before version 4.6.58 has a vulnerability in the _validate_origin method of MCP HTTP Stream, which accepts request_origin.startswith(allowed), allowing an attacker to use the localhost.evil.example origin that matches the localhost allowlist. Without an API key, a malicious webpage can submit tools/call requests to the local MCP server and execute exposed tools.

PraisonAI is a multi-agent system. Prior to praisonaiagents 1.6.58, AgentServer exposes ServerConfig.auth_token but AgentServer._create_app does not check it on any route. A remote caller can subscribe, publish, and perform other actions without a valid bearer token or X-Auth-Token even when authentication is configured. This issue is fixed in version 1.6.58.

PraisonAI is a multi-agent system. Prior to praisonaiagents 1.6.58, the FileMemory constructor joins unsanitized user_id into self.user_path. A caller supplying ../ or path separators can escape the memory directory and write JSON data to arbitrary process-writable locations. The fix sanitizes user_id before constructing self.user_path. This issue is fixed in version 1.6.58.

PraisonAI is a multi-agent system. Prior to praisonaiagents 1.6.58, spider_tools._host_is_blocked() does not resolve ordinary hostnames before scrape_page fetches them. A hostname such as 127.0.0.1.nip.io passes validation and resolves to loopback, permitting internal HTTP access. The fix uses socket.getaddrinfo and fails closed on DNS errors. This issue is fixed in version 1.6.58.

PraisonAI Platform API prior to version 0.1.4 has two authorization failures that together break workspace isolation. The service layer performs global primary-key lookups without checking workspace ownership, and member management endpoints only require min_role='member', allowing any member to promote themselves to owner and remove the original owner.

PraisonAI before version 1.6.58 contains an SSRF vulnerability in the web_crawl tool. The protection only checks the initial URL, but after redirects or DNS rebinding it connects to internal addresses such as loopback, private networks, or cloud metadata. An attacker can influence the URL passed to web_crawl to obtain responses from these internal resources.

PraisonAI versions 1.5.128 through 1.6.57 contain an SSRF vulnerability in the web_crawl() function. Despite initial URL validation, redirect targets are not checked, allowing an attacker to access internal resources via a public URL that redirects to loopback or private networks. This is an incomplete fix for previous SSRF vulnerabilities.

PraisonAI versions 3.9.26 through 4.6.57 (praisonai) and 0.12.12 through 1.6.57 (praisonaiagents) have a code execution vulnerability in the workflow include feature. The _execute_include() function imports and runs code from tools.py without proper safeguards, allowing an attacker to execute arbitrary Python code if they can influence a local workflow directory.

A vulnerability in PraisonAI versions prior to 4.6.40 allows arbitrary code execution through unguarded spec.loader.exec_module calls in agents_generator.py. These functions accept a module_path parameter from YAML configuration and execute it without validation, allowing an attacker to execute remote code.

Vulnerability in PraisonAI (versions prior to 4.6.40) where hidden metadata in a webpage causes PraisonAI agents to write attacker-controlled content to arbitrary paths. The write_file function skips path validation when workspace=None (always in production).

Vulnerability in PraisonAI (versions before 4.6.40) allows automatic fetching of content from URLs mentioned in CLI prompts. An attacker can inject a malicious URL, resulting in fetching localhost resources and injecting them into the model context, with no private address restrictions.

Vulnerability in PraisonAI (versions before 4.6.40) – incomplete fix for previous flaw (CVE-2026-44336). An unauthenticated attacker can read any file on the host (e.g., /etc/passwd, SSH keys) via MCP tools/call to praisonai.workflow.show.

In PraisonAI before version 4.6.40 (and praisonaiagents before 1.6.40), URL validation in `spider_tools` can be bypassed using alternate loopback host encodings. The validation only blocks exact strings like 'localhost' and '127.0.0.1', allowing SSRF to loopback services.