PraisonAI vulnerabilities

CVEs whose affected-version data names the PraisonAI package (npm, pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

158 CVEsRSS

CVE-2026-56075High· 8.8PoC

4mo ago

PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI modules hardcode approval_mode to auto, overriding administrator configuration from PRAISON_APPROVAL_MODE environment variable

PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI modules hardcode approval_mode to auto, overriding administrator configuration from PRAISON_APPROVAL_MODE environment variable. Authenticat…

PraisonAI vulnerabilities

PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI modules hardcode approval_mode to auto, overriding administrator configuration from PRAISON_APPROVAL_MODE environment variable

PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals

PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal

PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools

PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard

PraisonAI Slack app_mention bypasses configured user/channel authorization

PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage

PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing

PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools

PraisonAI recipe.run_stream skips dangerous-tool policy enforcement

PraisonAI: Compute-bridged file tools allow shell command injection

PraisonAI: Unauthenticated Local File Inclusion via agent_file path in PraisonAI Jobs API

PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass

praisonai: recipe serve auth middleware silently disables itself when no secret is set

PraisonAI: Jobs API exposes agent-execution endpoints with no authentication

PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding

PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation

PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)

PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai

PraisonAI Code agent tools fail open without a workspace boundary

PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion

npm PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation

npm PraisonAI codeMode sandbox escape via Function constructor

npm PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients

npm PraisonAI SandboxExecutor allowedCommands bypass via shell chaining

PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool

npm PraisonAI AgentOS exposes unauthenticated agent listing and invocation

npm PraisonAI MCPServer exposes unauthenticated HTTP tools/call

npm PraisonAI AgentLoop onToolCall approval runs after tool execution

npm PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining