PraisonAI vulnerabilities

CVEs whose affected-version data names the PraisonAI package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

PraisonAI vulnerabilities

PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate

PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334

PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context

PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings

PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute

PraisonAI's symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`

PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution

PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries

PraisonAI has unauthenticated RCE via `tool_override.py` (CVE-2026-40287 patch bypass)

PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)

PraisonAI: SQLiteConversationStore didn't validate table_prefix when constructing SQL queries

PraisonAI: Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate Limits

PraisonAI: Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOS

PraisonAI Vulnerable to Sensitive Environment Variable Exposure via Untrusted MCP Subprocess Execution

PraisonAI Vulnerable to RCE via Automatic tools.py Import

PraisonAI Vulnerable to Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars

PraisonAI Vulnerable to Decompression Bomb DoS via Recipe Bundle Extraction Without Size Limits

PraisonAI Vulnerable to Stored XSS via Unsanitized Agent Output in HTML Rendering (nh3 Not a Required Dependency)

PraisonAI Vulnerable to Server-Side Request Forgery via Unvalidated webhook_url in Jobs API

PraisonAI: Unauthenticated Allow-List Manipulation Bypasses Agent Tool Approval Safety Controls

PraisonAI Vulnerable to Code Injection and Protection Mechanism Failure

PraisonAI has Unrestricted Upload Size in WSGI Recipe Registry Server that Enables Memory Exhaustion DoS

PraisonAI Vulnerable to Implicit Execution of Arbitrary Code via Automatic `tools.py` Loading

PraisonAI: Hardcoded `approval_mode="auto"` in Chainlit UI Overrides Administrator Configuration, Enabling Unapproved Shell Command Execu…

PraisonAI has Template Injection in Agent Tool Definitions

PraisonAI Has Unauthenticated SSE Event Stream that Exposes All Agent Activity in A2U Server

PraisonAI recipe registry publish path traversal allows out-of-root file write

PraisonAI recipe registry pull path traversal writes files outside the chosen output directory

PraisonAI Has Arbitrary File Write (Zip Slip) in Templates Extraction

PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback

PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `main` callables execute