praisonaiagents has 51 CVEs on record. Disclosures have slowed: 14 in the last 90 days after 26 in the 90 before. The busiest recent month was April 2026 with 10. The median CVSS is 7.9 (high), with 5 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-918 (12) and CWE-22 (8).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.9
- Publish → KEV
- —
- Last 90 days
- 14 prev 26
Weakness classes
Products
- praisonaiagents 51
Worst active — by depth score
CVE-2026-61447Critical· 10.0PraisonAI before 1.6.78 contains a remote code execution vulnerability in CodeAgent._execute_python() that executes LLM-generated Python code without AST validation, import restrictions, or sandbox enforcement70CVE-2026-57118Critical· 9.8PraisonAI is a multi-agent teams system66CVE-2026-57143High· 8.8PraisonAI is a multi-agent teams system60GHSA-x8cv-xmq7-p8xpCritical· 9.8PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints54GHSA-x227-pf99-vffgCritical· 9.8PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in54
praisonaiagents vulnerabilities
CVEs affecting praisonaiagents, newest first. Open any entry for full detail, references, and exploit status.
51 CVEsRSS
GHSA-pv2j-rghr-v5r9Medium· 6.5PraisonAI: execute_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunder
PraisonAI: execute_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunder
GHSA-x227-pf99-vffgCritical· 9.8PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in
PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in
GHSA-vxgj-xg5c-p4h7High· 8.5praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS
praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS
GHSA-2rcg-mm5h-xchxHigh· 7.5PraisonAI: Arbitrary File Read via `@file:` Mention Path Traversal
PraisonAI: Arbitrary File Read via `@file:` Mention Path Traversal
GHSA-x8cv-xmq7-p8xpCritical· 9.8PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints
PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints
GHSA-c969-5x3p-vq3vHigh· 8.1PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters
PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters
GHSA-4pcv-mg8v-vrgfHigh· 8.8PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter
PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter
CVE-2026-47395Medium· 5.5PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context
PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context
CVE-2026-47390Medium· 5.5PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings
PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings
CVE-2026-44339High· 8.6PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute
PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute
CVE-2026-44335Critical· 9.8PraisonAI has an SSRF bypass
PraisonAI has an SSRF bypass
GHSA-x462-jjpc-q4q4High· 8.1PraisonAI: Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI Endpoint
PraisonAI: Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI Endpoint
CVE-2026-40153High· 7.4PraisonAIAgents: Environment Variable Secret Exfiltration via os.path.expandvars() Bypassing shell=False in Shell Tool
PraisonAIAgents: Environment Variable Secret Exfiltration via os.path.expandvars() Bypassing shell=False in Shell Tool
CVE-2026-40160HighPraisonAIAgents: SSRF via unvalidated URL in `web_crawl` httpx fallback
PraisonAIAgents: SSRF via unvalidated URL in `web_crawl` httpx fallback
CVE-2026-40117Medium· 6.2PraisonAIAgents: Arbitrary File Read via read_skill_file Missing Workspace Boundary and Approval Gate
PraisonAIAgents: Arbitrary File Read via read_skill_file Missing Workspace Boundary and Approval Gate
CVE-2026-40287High· 8.4PraisonAI Vulnerable to RCE via Automatic tools.py Import
PraisonAI Vulnerable to RCE via Automatic tools.py Import
CVE-2026-40150High· 7.7PraisonAIAgents has SSRF and Local File Read via Unvalidated URLs in web_crawl Tool
PraisonAIAgents has SSRF and Local File Read via Unvalidated URLs in web_crawl Tool
CVE-2026-40152Medium· 5.3PraisonAIAgents: Path Traversal via Unvalidated Glob Pattern in list_files Bypasses Workspace Boundary
PraisonAIAgents: Path Traversal via Unvalidated Glob Pattern in list_files Bypasses Workspace Boundary
CVE-2026-56078Medium· 6.5PraisonAI has Memory State Leakage and Path Traversal in MultiAgent Context Handling
PraisonAI has Memory State Leakage and Path Traversal in MultiAgent Context Handling
CVE-2026-34937High· 7.8PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution
PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution
CVE-2026-34954High· 8.6PraisonAI Has SSRF in FileTools.download_file() via Unvalidated URL
PraisonAI Has SSRF in FileTools.download_file() via Unvalidated URL