PraisonAI has 113 CVEs on record. Disclosures have slowed: 22 in the last 90 days after 69 in the 90 before. The busiest recent month was June 2026 with 38. The median CVSS is 8.0 (high), with 18 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-306 (20) and CWE-22 (14).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.0
- Publish → KEV
- —
- Last 90 days
- 22 prev 69
Weakness classes
Products
- praisonai 113
Worst active — by depth score
CVE-2026-56075High· 8.8PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI modules hardcode approval_mode to auto, overriding administrator configuration from PRAISON_APPROVAL_MODE environment variable61CVE-2026-44338High· 7.3PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution59CVE-2026-56076High· 8.1PraisonAI before 1.5.128 contains a cross-origin agent execution vulnerability in the AGUI endpoint that allows remote attackers to trigger arbitrary agent execution57GHSA-mhgx-w3w5-2rvcCritical· 10.0Duplicate Advisory: PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets55CVE-2026-61445Critical· 9.9PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component due to missing path validation and command sanitization in LLM tool calls55
PraisonAI vulnerabilities
CVEs affecting PraisonAI, newest first. Open any entry for full detail, references, and exploit status.
113 CVEsRSS
GHSA-p4pj-vh7h-6cqhHigh· 7.5PraisonAI: Unauthenticated Local File Inclusion via agent_file path in PraisonAI Jobs API
PraisonAI: Unauthenticated Local File Inclusion via agent_file path in PraisonAI Jobs API
GHSA-4869-x4pr-q22xCritical· 9.8PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass
PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass
GHSA-j4hj-7hfh-g2f4Critical· 9.8praisonai: recipe serve auth middleware silently disables itself when no secret is set
praisonai: recipe serve auth middleware silently disables itself when no secret is set
GHSA-fq2m-6wqh-x44gCritical· 9.8PraisonAI: Jobs API exposes agent-execution endpoints with no authentication
PraisonAI: Jobs API exposes agent-execution endpoints with no authentication
GHSA-rjvw-7vvw-549vHigh· 7.2PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding
PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding
GHSA-892r-p3jq-jp24Critical· 9.8PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation
PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation
GHSA-x92v-rpx6-p6cwHigh· 8.6PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)
PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)
GHSA-p75f-6fp4-p57wCritical· 9.8PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai
PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai
GHSA-gcq3-mfvh-3x25High· 7.3PraisonAI Code agent tools fail open without a workspace boundary
PraisonAI Code agent tools fail open without a workspace boundary
GHSA-f44v-7qgw-9gh9High· 8.1PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion
PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion
GHSA-4qq2-2j2x-x62cHigh· 8.2npm PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation
npm PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation
GHSA-vmmj-pfw7-fjwpCritical· 9.9npm PraisonAI codeMode sandbox escape via Function constructor
npm PraisonAI codeMode sandbox escape via Function constructor
GHSA-gqmf-56h7-rrpfHigh· 7.6npm PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients
npm PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients
GHSA-vjv9-7m7j-h833High· 8.8npm PraisonAI SandboxExecutor allowedCommands bypass via shell chaining
npm PraisonAI SandboxExecutor allowedCommands bypass via shell chaining
GHSA-p69m-4f92-2v84Critical· 9.8PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool
PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool
GHSA-9752-mhqh-h34fCritical· 9.4npm PraisonAI AgentOS exposes unauthenticated agent listing and invocation
npm PraisonAI AgentOS exposes unauthenticated agent listing and invocation
GHSA-j4f3-55x4-r6q2Critical· 9.8npm PraisonAI MCPServer exposes unauthenticated HTTP tools/call
npm PraisonAI MCPServer exposes unauthenticated HTTP tools/call
GHSA-h2w2-v7j6-xqm4High· 8.8npm PraisonAI AgentLoop onToolCall approval runs after tool execution
npm PraisonAI AgentLoop onToolCall approval runs after tool execution
GHSA-5jv7-2mjm-h6qjHigh· 8.8npm PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining
npm PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining
GHSA-7qw2-w5rc-37x2High· 7.8PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml
PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml
GHSA-jxcw-qp4h-6jfqHigh· 7.5PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default
PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default
GHSA-29w3-p9w9-wc47Critical· 9.1PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation
PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation
GHSA-8ccj-p46r-jwqqHigh· 8.2PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication
PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication
GHSA-6jcq-6546-qrrwHigh· 8.8PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable
PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable
CVE-2026-47393Critical· 9.8PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default
PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default
CVE-2026-47397HighPraisonAI has an Arbitrary File Write in Python API
PraisonAI has an Arbitrary File Write in Python API
CVE-2026-47394HighPraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate
PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate
CVE-2026-47398High· 8.1PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334
PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334
CVE-2026-44340High· 7.5PraisonAI's symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`
PraisonAI's symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`
CVE-2026-44338High· 7.3PoCPraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution
PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution