PraisonAI Affected by Untrusted Remote Template Code Execution (MervinPraison PraisonAI)
En bref
- Source
- NVD
- EPSS
- EPSS 0.30 % · centile 23 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- GitHub_M
- Statut NVD
- Analyzed
Description
PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI treats remotely fetched template files as trusted executable code without integrity verification, origin validation, or user confirmation, enabling supply chain attacks through malicious templates. This vulnerability is fixed in 4.5.128.
Faiblesses (CWE)
- CWE-829 — Inclusion de fonctionnalités depuis une sphère non fiable
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N | GitHub_M |
| CVSS 3.1 | CRITICAL 9.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | CRITICAL 9.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-pv9q-275h-rh7x — PraisonAI Vulnerable Untrusted Remote Template Code Execution
- PYSEC-2026-476 — PraisonAI Vulnerable Untrusted Remote Template Code Execution
Références européennes
- ENISA EUVD · EUVD-2026-21212
- GCVE · GCVE-0-2026-40154
Configurations affectées (CPE NVD)
cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:*< 4.5.128
Produits affectés
| Produit | Versions |
|---|---|
| MervinPraison · PraisonAI | affected < 4.5.128 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |