PraisonAI vulnerabilities

PraisonAI before version 1.6.78 contains a remote code execution vulnerability in the plugin manager. It loads and executes arbitrary Python (.py) files from .praisonai/plugins/ directories without code signing, integrity verification, or sandboxing. An attacker who can write a malicious .py file to a plugin directory (e.g., via path traversal, supply chain attack, or compromised dependency) achieves arbitrary code execution when the plugin system initializes.

PraisonAI before version 1.6.78 contains a remote code execution vulnerability in SkillTools.run_skill_script() that executes scripts without path containment validation. Attackers can supply absolute file paths to execute arbitrary scripts from any filesystem location, including those outside the intended working directory.

PraisonAI before version 4.6.78 contains a remote code execution vulnerability in the JobWorkflowExecutor._exec_inline_python() function due to insufficient AST validation of workflow script steps. Attackers can create malicious YAML workflow files with import os statements followed by os.system() calls that bypass sandbox checks and execute arbitrary OS commands with process privileges.

A vulnerability in PraisonAI before version 4.6.78 in AgentMail webhook mode fails to verify Svix webhook signatures, allowing unauthenticated attackers to forge message.received events. Attackers can send crafted JSON payloads to the webhook endpoint to invoke configured agents with arbitrary sender addresses and message content.

A vulnerability in PraisonAI before version 4.6.78 allows authentication bypass in the Call API agent invocation endpoints (agent_invoke.py) when PRAISONAI_CALL_AUTH=disabled is configured. The safeguard restricting access to localhost relies on the HTTP Host header, which can be spoofed by an attacker.

PraisonAI before version 4.6.78 unsafely encodes deployment configuration values when generating Python source code for API servers. Attackers can inject arbitrary Python expressions through the deploy.api.host and agents_file configuration parameters, which execute when the server starts or handles requests.

PraisonAI before version 1.6.78 contains a server-side request forgery (SSRF) vulnerability in the web_crawl tool. It validates hostnames at check time but re-resolves them at connection time without IP pinning. Attackers can use DNS rebinding to bypass SSRF protection and retrieve internal HTTP response bodies from private or loopback services.

PraisonAI before version 4.6.78 exposes the MCP HTTP-stream transport without authentication by default. When an operator runs the server without an API key, an unauthenticated client can initialize a session, enumerate available tools, and invoke them. Additionally, the server does not validate tool-call arguments against the advertised inputSchema.

The vulnerability in PraisonAI before version 1.6.78 caches tool approval decisions solely by tool name, allowing attackers to reuse initial approvals for subsequent calls with arbitrary arguments. Attackers can exploit this by obtaining approval for a benign operation and then executing dangerous file write operations with unreviewed parameters in the same session.

PraisonAI before version 4.6.78 has a vulnerability where the default Subprocess Sandbox backend ignores all configured security policies. Blocked commands, paths, imports, subprocess restrictions, and file write restrictions are completely bypassed.

A vulnerability in PraisonAI before version 4.6.78 stems from a misconfigured prompt injection defense where the default block threshold is set to CRITICAL severity. This allows HIGH-severity attacks to pass through unblocked, enabling system prompt extraction and unauthorized tool invocations.

An SSRF vulnerability in the Crawl4AI/Chromium backend of PraisonAI before version 1.6.78 allows attackers to bypass SSRF validation via DNS rebinding and HTTP redirects. Attackers can craft URLs that resolve to internal services after initial validation, enabling the headless browser to read sensitive internal responses including canary values.

PraisonAI before version 1.7.3 has an insecure default configuration that binds to all network interfaces, requires no API key, and allows wildcard CORS. Unauthenticated attackers can read agent instructions and system prompts via GET /api/agents or invoke agents without authentication via POST /api/chat.

A vulnerability in PraisonAI before version 4.6.78 fails to validate file path references in custom command templates, allowing attackers to read files outside the workspace. Attackers can use path traversal sequences like @../outside_secret.txt or absolute paths to exfiltrate process-readable files into model prompts.

In PraisonAI (pip package praisonaiagents) before version 1.6.78, an unsafe dynamic module loading vulnerability exists in AgentFlow._resolve_pydantic_class. When a workflow step uses an output_pydantic reference, the framework imports a sibling tools.py from the workflow file's directory without sandboxing, ignoring PRAISONAI_ALLOW_*_TOOLS environment variables. An attacker controlling a workflow file and its sibling tools.py can execute arbitrary Python code with the workflow runner's privileges.

A vulnerability in PraisonAI before version 4.6.78 allows bypassing the prompt injection defense mechanism. The defense only blocks threats classified as CRITICAL, requiring three or more detector families to match simultaneously. Attackers can craft single or double-vector prompt injections classified as HIGH threat level, which pass through unblocked to the model.

PraisonAI before version 0.1.7 fails to validate that the project_id in issue create and update request bodies belongs to the URL workspace. An attacker can create issues referencing projects from other workspaces, causing cross-tenant data pollution in project statistics aggregation without workspace constraints.

PraisonAI before 1.5.128 contains a cross-origin agent execution vulnerability in the AGUI endpoint that allows remote attackers to trigger arbitrary agent execution. The POST /agui endpoint lacks authentication and hardcodes Access-Control-Allow-Origin: * headers, enabling attackers to bypass CORS preflight checks.

PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI modules hardcode approval_mode to auto, overriding administrator configuration from PRAISON_APPROVAL_MODE environment variable. Authenticated attackers can instruct the LLM agent to execute arbitrary shell commands.

PraisonAI versions before 1.5.128 cache tool approval decisions based only on tool name, not invocation arguments, allowing subsequent execute_command calls to bypass approval prompts.

PraisonAI before version 4.5.115 contains a template injection vulnerability in the create_agent_centric_tools() function. User input passed to agent.start() is processed without proper escaping, allowing template expressions to be executed instead of being treated as literal text.

PraisonAI before version 4.5.115 exposes the A2U (Agent-to-User) event stream server without authentication. The create_a2u_routes() function registers endpoints /a2u/info, /a2u/subscribe, /a2u/events/{stream_name}, /a2u/events/sub/{id}, and /a2u/health with no access controls.

PraisonAI before version 4.5.97 contains a vulnerability in SubprocessSandbox in all modes (BASIC, STRICT, NETWORK_ISOLATED). The subprocess.run() function is called with shell=True and relies solely on string-pattern matching to block dangerous commands. The blocklist does not include sh or bash as standalone executables, allowing trivial sandbox escape in STRICT mode via sh -c '<command>'.

In PraisonAI before version 1.5.95, the FileTools.download_file() function does not validate the URL parameter, passing it directly to httpx.stream() with follow_redirects=True. An attacker controlling the URL can reach any host accessible from the server, including cloud metadata and internal services.

Vulnerability in PraisonAI before version 4.5.90, where MCPToolIndex.search_tools() compiles a caller-supplied string directly as a Python regular expression without validation, sanitization, or timeout. A crafted regex causes catastrophic backtracking in the re engine, blocking the Python thread for hundreds of seconds and causing a complete service outage.

PraisonAI before version 1.5.90 contains a command injection vulnerability in the run_python() function. The function constructs a shell command from user input without proper escaping, allowing arbitrary OS command execution before Python is invoked.

PraisonAI prior to version 4.5.90 has a vulnerability in passthrough() and apassthrough() functions that accept a caller-controlled api_base parameter. This parameter is concatenated with the endpoint and passed to httpx.Client.request() without URL scheme validation, private IP filtering, or domain allowlist, allowing requests to any host reachable from the server. The issue has been fixed in version 4.5.90.