praisonaiagents has 51 CVEs on record. Cadence is steady at roughly 17 per quarter. The busiest recent month was April 2026 with 10. The median CVSS is 7.9 (high), with 5 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-918 (12) and CWE-22 (8).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.9
- Publish → KEV
- —
- Last 90 days
- 17 prev 24
Weakness classes
Products
- praisonaiagents 51
Worst active — by depth score
CVE-2026-61447Critical· 10.0PraisonAI before 1.6.78 contains a remote code execution vulnerability in CodeAgent._execute_python() that executes LLM-generated Python code without AST validation, import restrictions, or sandbox enforcement70CVE-2026-57118Critical· 9.8PraisonAI is a multi-agent teams system66CVE-2026-57143High· 8.8PraisonAI is a multi-agent teams system60GHSA-x8cv-xmq7-p8xpCritical· 9.8PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints54GHSA-x227-pf99-vffgCritical· 9.8PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in54
praisonaiagents vulnerabilities
CVEs affecting praisonaiagents, newest first. Open any entry for full detail, references, and exploit status.
51 CVEsRSS
CVE-2026-57118Critical· 9.8PoCPraisonAI is a multi-agent teams system
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register GET /{path}/list, POST /{path}, and `POST /{path}/{agent_id}' without access-control checks before listing agents or…
CVE-2026-57143High· 8.8PoCPraisonAI is a multi-agent teams system
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_web SearxNG provider pass the LLM-controlled searxng_url parameter directly to requests.get without validating its scheme, host, port…
CVE-2026-60089MediumPraisonAI: Project config can auto-save agent output outside the project root
PraisonAI: Project config can auto-save agent output outside the project root
CVE-2026-61430High· 8.5PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure
PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure
CVE-2026-60087Medium· 6.1PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments
PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments
CVE-2026-61446High· 8.4PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification
PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification
CVE-2026-61437High· 7.8PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow
PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow
CVE-2026-61432Medium· 5.7PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace
PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace
CVE-2026-61443High· 8.1PraisonAI: SkillTools Executes Scripts Without Path Containment Validation
PraisonAI: SkillTools Executes Scripts Without Path Containment Validation
CVE-2026-55528High· 8.2praisonaiagents: AgentServer declares auth_token but never enforces it on any route
praisonaiagents: AgentServer declares auth_token but never enforces it on any route
CVE-2026-55526High· 8.5praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)
praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)
CVE-2026-55530Medium· 6.1praisonaiagents: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool
praisonaiagents: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool
CVE-2026-55527High· 7.1praisonaiagents vulnerable to arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable …
praisonaiagents vulnerable to arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location
CVE-2026-55525High· 7.5praisonaiagents web_crawl vulnerable to SSRF via redirect-following
praisonaiagents web_crawl vulnerable to SSRF via redirect-following
CVE-2026-55524High· 7.5PraisonAI is a multi-agent teams system
PraisonAI is a multi-agent teams system. In versions prior to 1.6.58, the web_crawl tool performs its SSRF check only on the initially supplied URL, allowing the protection to be bypassed so the tool connects to attacker-chosen internal …
CVE-2026-55522High· 7.8PraisonAI is a multi-agent teams system
PraisonAI is a multi-agent teams system. In versions 3.9.26 through 4.6.57 of praiseonai and 0.12.12 through 1.6.57 of praiseonaiagents, the workflow "include" feature is vulnerable to code execution. Workflow._execute_include() implicit…
CVE-2026-55523HighPraisonAI is a multi-agent teams system
PraisonAI is a multi-agent teams system. In versions 1.5.128 through 1.6.57, the praisonaiagents.tools.web_crawl_tools.web_crawl() function is vulnerable to server-side request forgery. While it validates the initially supplied URL and b…
GHSA-92x2-g374-gcvxHigh· 8.5Duplicate Advisory: PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure
Duplicate Advisory: PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure
GHSA-r3xw-gcpr-rf26Medium· 6.1Duplicate Advisory: PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments
Duplicate Advisory: PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments
GHSA-q359-rmv4-56fgHigh· 8.4Duplicate Advisory: PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification
Duplicate Advisory: PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification
GHSA-f352-4x87-wmjhHigh· 8.1Duplicate Advisory: PraisonAI: SkillTools Executes Scripts Without Path Containment Validation
Duplicate Advisory: PraisonAI: SkillTools Executes Scripts Without Path Containment Validation
GHSA-rc3q-9pxg-3jhrHigh· 8.5Duplicate Advisory: PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass
Duplicate Advisory: PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass
CVE-2026-61447Critical· 10.0PoCPraisonAI before 1.6.78 contains a remote code execution vulnerability in CodeAgent._execute_python() that executes LLM-generated Python code without AST validation, import restrictions, or sandbox enforcement
PraisonAI before 1.6.78 contains a remote code execution vulnerability in CodeAgent._execute_python() that executes LLM-generated Python code without AST validation, import restrictions, or sandbox enforcement. Attackers can influence LL…
CVE-2026-61429High· 8.5PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the Crawl4AI/Chromium backend that allows attackers to bypass SSRF validation by exploiting DNS rebinding and HTTP redirects
PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the Crawl4AI/Chromium backend that allows attackers to bypass SSRF validation by exploiting DNS rebinding and HTTP redirects. Attackers can craft URL…
GHSA-rrqj-82cc-g6h4Medium· 5.5Duplicate Advisory: PraisonAI: Project config can auto-save agent output outside the project root
Duplicate Advisory: PraisonAI: Project config can auto-save agent output outside the project root
GHSA-c6pq-cprj-62fwHigh· 7.8Duplicate Advisory: PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow
Duplicate Advisory: PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow
GHSA-3f4v-mp44-x4x2Medium· 5.7Duplicate Advisory: PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace
Duplicate Advisory: PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace
GHSA-35w5-pcw4-jx94Medium· 4.3PraisonAI: Unauthenticated Event Injection via SSE `/publish` Endpoint
PraisonAI: Unauthenticated Event Injection via SSE `/publish` Endpoint
GHSA-vmf9-xx9w-86wxHigh· 8.3PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools
PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools
GHSA-6h9p-93hq-q7h6Medium· 6.5PraisonAI: SpiderTools redirect-target SSRF protection bypass
PraisonAI: SpiderTools redirect-target SSRF protection bypass