praisonai has 92 CVEs on record. Disclosures have slowed: 12 in the last 90 days after 80 in the 90 before. The busiest recent month was June 2026 with 50. The median CVSS is 8.1 (high), with 13 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-306 (15) and CWE-863 (12).
CVEs per month
Last 12 months, by publish date
1025/101125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/09
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.1
- Publish → KEV
- —
- Last 90 days
- 12 prev 80
Weakness classes
Products
- praisonai 92
92
Total CVEs
13
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
GHSA-vmmj-pfw7-fjwpCritical· 9.9npm PraisonAI codeMode sandbox escape via Function constructor54GHSA-p75f-6fp4-p57wCritical· 9.8PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai54GHSA-p69m-4f92-2v84Critical· 9.8PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool54GHSA-j4hj-7hfh-g2f4Critical· 9.8praisonai: recipe serve auth middleware silently disables itself when no secret is set54GHSA-j4f3-55x4-r6q2Critical· 9.8npm PraisonAI MCPServer exposes unauthenticated HTTP tools/call54
praisonai vulnerabilities
CVEs affecting praisonai, newest first. Open any entry for full detail, references, and exploit status.
92 CVEsRSS
CVE-2026-34955High· 8.8PraisonAI Has Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandbox
PraisonAI Has Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandbox
▾ Twilightpraisonai · praisonaiEPSS 0.39%via OSV
CVE-2026-34939Medium· 6.5PraisonAI Has ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools()
PraisonAI Has ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools()
▾ Sunlitpraisonai · praisonaiEPSS 0.45%via OSV