MervinPraison PraisonAI
147 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-57117 | >= 4.6.10, < 4.6.59 | PraisonAI: Compute-bridged file tools allow shell command injection | HIGH 8.8 | 0.6 % | ||
| CVE-2026-57146 | >= 4.5.115, < 4.6.61 | PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default | HIGH 7.5 | 0.5 % | ||
| CVE-2026-57144 | >= 4.5.110, < 4.6.61 | PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable | HIGH 8.8 | 0.2 % | ||
| CVE-2026-57142 | >= 4.5.87, < 4.6.61 | PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml | HIGH 7.8 | 0.2 % | ||
| CVE-2026-57121 | >= 0.1.4, < 0.1.5 | PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API | HIGH 8.1 | 0.3 % | ||
| CVE-2026-57116 | >= 4.2.1, < 4.6.59 | PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-57114 | >= 4.5.126, < 4.6.59 | PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding | HIGH 7.2 | 0.3 % | ||
| CVE-2026-57113 | >= 2.6.0, < 4.6.59 | PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion | HIGH 8.1 | 0.4 % | ||
| CVE-2026-56840 | >= 4.5.2, < 4.6.59 | PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools | HIGH 8.8 | 0.4 % | ||
| CVE-2026-56838 | >= 4.5.87, < 4.6.59 | PraisonAI recipe.run_stream skips dangerous-tool policy enforcement | HIGH 7.8 | 0.1 % | ||
| CVE-2026-56837 | >= 4.6.56, < 4.6.59 | PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing | HIGH 8.6 | 0.2 % | ||
| CVE-2026-56836 | >= 4.5.112, < 4.6.59 | PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard | HIGH 8.2 | 0.3 % | ||
| CVE-2026-56835 | >= 3.11.0, < 4.6.59 | PraisonAI Slack app_mention bypasses configured user/channel authorization | HIGH 8.3 | 0.2 % | ||
| CVE-2026-56834 | >= 3.8.1, < 4.6.59 | PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage | HIGH 7.5 | 0.4 % | ||
| CVE-2026-56833 | >= 3.8.1, < 4.6.59 | PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal | HIGH 7.5 | 0.5 % | ||
| CVE-2026-56832 | >= 4.5.2, < 4.6.59 | PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals | HIGH 8.8 | 0.1 % | ||
| CVE-2026-57118 | < 4.6.59 | PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-62176 | < 4.6.78 | PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation | CRITICAL 9.1 | 0.5 % | ||
| CVE-2026-57147 | < 4.6.51 | praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery | CRITICAL 9.8 | 0.8 % | ||
| CVE-2026-57148 | < 4.6.51 | praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard) | CRITICAL 9.8 | 0.6 % | ||
| CVE-2026-57140 | >= 1.6.0, < 1.7.2 | PraisonAI AgentOS exposes unauthenticated agent listing and invocation | CRITICAL 9.4 | 0.6 % | ||
| CVE-2026-57139 | >= 1.5.0, < 1.7.2 | PraisonAI MCPServer exposes unauthenticated HTTP tools/call | CRITICAL 9.8 | 0.8 % | ||
| CVE-2026-57133 | >= 1.5.1, < 1.7.2 | PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining | HIGH 8.8 | 0.8 % | ||
| CVE-2026-57135 | >= 1.2.3, < 1.7.2 | PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients | HIGH 7.6 | 0.4 % | ||
| CVE-2026-57134 | >= 1.5.1, < 1.7.2 | PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation | HIGH 8.2 | 0.4 % | ||
| CVE-2026-57138 | >= 1.4.0, < 1.7.2 | PraisonAI codeMode sandbox escape via Function constructor | CRITICAL 9.9 | 0.7 % | ||
| CVE-2026-57136 | >= 1.2.3, < 1.7.2 | PraisonAI SandboxExecutor allowedCommands bypass via shell chaining | HIGH 8.8 | 0.5 % | ||
| CVE-2026-57137 | >= 1.4.0, < 1.7.2 | PraisonAI AgentLoop onToolCall approval runs after tool execution | HIGH 8.8 | 0.5 % | ||
| CVE-2026-57141 | < 1.7.2 | PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool | CRITICAL 9.8 | 0.7 % | ||
| CVE-2026-57112 | >= 3.10.0, < 4.6.59 | PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools | HIGH 8.3 | 0.2 % | ||
| CVE-2026-57145 | < 4.6.62 | PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation | CRITICAL 9.1 | 0.5 % | ||
| CVE-2026-57132 | < 4.6.62 | PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication | HIGH 8.2 | 0.5 % | ||
| CVE-2026-57131 | < 4.6.48 | praisonai: Jobs API exposes agent-execution endpoints with no authentication | CRITICAL 9.8 | 1.0 % | ||
| CVE-2026-57124 | < 4.6.59 | PraisonAI UI MCP connect endpoint allows unauthenticated local command execution | CRITICAL 9.8 | 1.0 % | ||
| CVE-2026-57122 | < 4.6.59 | PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots) | HIGH 8.6 | 0.2 % | ||
| CVE-2026-57127 | < 4.6.48 | praisonai: recipe serve auth middleware silently disables itself when no secret is set | CRITICAL 9.8 | 0.9 % | ||
| CVE-2026-56839 | < 4.6.59 | PraisonAI Code agent tools fail open without a workspace boundary | HIGH 7.3 | 0.4 % | ||
| CVE-2026-57119 | < 4.6.59 | PraisonAI: Unauthenticated Local File Inclusion via agent_file path in the Jobs API | HIGH 7.5 | 0.5 % | ||
| CVE-2026-57126 | < 1.6.59 | praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS | HIGH 8.5 | 0.4 % | ||
| CVE-2026-57128 | < 1.6.58 | PraisonAI: Unauthenticated Event Injection via SSE `/publish` Endpoint | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-57115 | < 4.6.59 | PraisonAI: SpiderTools redirect-target SSRF protection bypass | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-57125 | < 4.6.59 | PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass | CRITICAL 9.8 | 0.6 % | ||
| CVE-2026-55536 | < 4.6.58 | Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92) | CRITICAL 9.1 | 0.5 % | ||
| CVE-2026-55532 | < 4.6.58 | PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MC… | HIGH 7.6 | 0.2 % | ||
| CVE-2026-55533 | < 4.6.58 | PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret | HIGH 8.2 | 0.5 % | ||
| CVE-2026-55539 | < 4.6.58 | PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, c… | HIGH 8.6 | 0.6 % | ||
| CVE-2026-55527 | < 1.6.58 | PraisonAI: Arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location | HIGH 7.1 | 0.5 % | ||
| CVE-2026-55541 | < 4.6.58 | PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced | HIGH 8.8 | 0.5 % | ||
| CVE-2026-55535 | < 4.6.58 | PraisonAI: Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation | MEDIUM 6.8 | 0.3 % | ||
| CVE-2026-55537 | < 4.6.58 | PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114 | HIGH 7.1 | 0.3 % | ||
| CVE-2026-55538 | < 4.6.58 | PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/… | HIGH 7.3 | 0.4 % | ||
| CVE-2026-55540 | < 4.6.58 | PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks | HIGH 7.1 | 0.4 % | ||
| CVE-2026-55530 | < 4.6.58 | PraisonAI: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-55534 | >= 4.6.34, < 4.6.58 | PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution | HIGH 8.6 | 0.5 % | ||
| CVE-2026-55526 | < 4.6.58 | PraisonAI: SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`) | HIGH 8.5 | 0.4 % | ||
| CVE-2026-55531 | < 4.6.58 | PraisonAI: Unauthenticated unbounded session accumulation in the PraisonAI MCP HTTP server (memory exhaustion; session TTL never enforced) | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-55528 | < 4.6.58 | praisonaiagents: AgentServer declares auth_token but never enforces it on any route (CWE-862) | HIGH 8.2 | 0.5 % | ||
| CVE-2026-55529 | < 4.6.58 | PraisonAI: Origin validation bypass in MCP HTTP Stream transport allows browser-mediated unauthenticated tool execution on local MCP server | MEDIUM 6.9 | 0.2 % | ||
| CVE-2026-55525 | < 4.6.58 | PraisonAI: SSRF via redirect-following in praisonaiagents web_crawl | HIGH 7.5 | 0.5 % | ||
| CVE-2026-55524 | < 1.6.58 | PraisonAI: SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap) | HIGH 7.5 | 0.2 % | ||
| CVE-2026-55523 | >= 1.5.128, < 1.6.58 | PraisonAI has a`web_crawl` SSRF protection bypass via unchecked redirect targets | HIGH 7.7 | 0.5 % | ||
| CVE-2026-55522 | >= 3.9.26, < 4.6.58 | PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code | HIGH 7.8 | 0.2 % | ||
| CVE-2026-48168 | < 4.6.40 | PraisonAI: GitHub Actions Claude workflow command injection via unquoted PR branch name | CRITICAL 10.0 | 1.5 % | ||
| CVE-2026-47398 | < 4.6.40 | PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334 | HIGH 8.1 | 0.5 % | ||
| CVE-2026-47397 | < 4.6.40 | PraisonAI has an Arbitrary File Write in Python API | HIGH 7.1 | 0.5 % | ||
| CVE-2026-47396 | < 4.6.40 | PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-47395 | < 4.6.40 | PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-47394 | < 4.6.40 | PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate | HIGH 8.7 | 0.5 % | ||
| CVE-2026-47393 | < 4.6.40 | PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default | CRITICAL 9.8 | 0.6 % | ||
| CVE-2026-47392 | < 4.6.40 | PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode) | CRITICAL 9.9 | 0.9 % | ||
| CVE-2026-47391 | < 4.6.40 | PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution | CRITICAL 9.8 | 1.5 % | ||
| CVE-2026-47390 | < 4.6.40 | PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-61446 | < 1.6.78 | PraisonAI before 1.6.78 Remote Code Execution via Plugin Auto-Discovery | HIGH 8.6 | 0.3 % | ||
| CVE-2026-61443 | < 1.6.78 | PraisonAI before 1.6.78 Remote Code Execution via SkillTools | HIGH 8.6 | 0.6 % | ||
| CVE-2026-61440 | < 0.1.9 | PraisonAI Platform before 0.1.9 Authorization Bypass via Label Endpoints | HIGH 7.1 | 0.3 % | ||
| CVE-2026-61438 | < 4.6.78 | PraisonAI before 4.6.78 Remote Code Execution via Broken AST Sandbox | HIGH 7.0 | 0.3 % | ||
| CVE-2026-61436 | < 4.6.78 | PraisonAI before 4.6.78 Missing Webhook Signature Verification | HIGH 8.8 | 0.4 % | ||
| CVE-2026-61435 | < 4.6.78 | PraisonAI before 4.6.78 Authentication Bypass via Host Header Spoofing | HIGH 8.8 | 0.5 % | ||
| CVE-2026-61433 | < 4.6.78 | PraisonAI before 4.6.78 Code Injection via API deployment generator | HIGH 8.5 | 0.2 % | ||
| CVE-2026-61430 | < 1.6.78 | PraisonAI before 1.6.78 DNS Rebinding SSRF via web_crawl | HIGH 8.4 | 0.3 % | ||
| CVE-2026-61427 | < 4.6.78 | PraisonAI before 4.6.78 Authentication Bypass via HTTP-stream | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-60087 | < 1.6.78 | PraisonAI before 1.6.78 Tool Approval Cache Bypass | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-60085 | < 4.6.78 | PraisonAI before 4.6.78 Unenforced Security Policy in Subprocess Sandbox | HIGH 8.7 | 0.3 % | ||
| CVE-2026-61447 | < 1.6.78 | PraisonAI before 1.6.78 Remote Code Execution via CodeAgent | CRITICAL 10.0 | 15 % | ||
| CVE-2026-61445 | < 4.6.78 | PraisonAI before 4.6.78 Arbitrary File Write and Command Execution | CRITICAL 9.4 | 0.6 % | ||
| CVE-2026-61442 | < 0.1.9 | PraisonAI Platform before 0.1.9 Authorization Bypass via PATCH | HIGH 7.1 | 0.3 % | ||
| CVE-2026-61439 | < 4.6.78 | PraisonAI before 4.6.78 Prompt Injection Defense Bypass | HIGH 8.7 | 0.3 % | ||
| CVE-2026-61429 | < 1.6.78 | PraisonAI before 1.6.78 SSRF via Crawl4AI Chromium backend | HIGH 8.4 | 0.3 % | ||
| CVE-2026-61428 | < 4.6.78 | PraisonAI AgentMail before 4.6.78 Message Injection via Webhook | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-61426 | < 1.7.3 | PraisonAI before 1.7.3 Unauthenticated Agent Access via Insecure Defaults | HIGH 8.8 | 0.4 % | ||
| CVE-2026-60090 | < 4.6.78 | PraisonAI before 4.6.78 SQL/CQL Injection via vector dimension | CRITICAL 9.3 | 0.7 % | ||
| CVE-2026-60088 | < 4.6.78 | PraisonAI before 4.6.78 Path Traversal via Custom Commands | MEDIUM 6.8 | 0.2 % | ||
| CVE-2026-61444 | < 4.6.78 | PraisonAI before 4.6.78 Code Injection via f-string | CRITICAL 9.4 | 0.5 % | ||
| CVE-2026-61441 | < 0.1.9 | PraisonAI Platform before 0.1.9 Authorization Bypass via Dependencies | HIGH 7.1 | 0.3 % | ||
| CVE-2026-61437 | < 1.6.78 | PraisonAI before 1.6.78 Remote Code Execution via tools.py | HIGH 8.5 | 0.2 % | ||
| CVE-2026-61434 | < 4.6.78 | PraisonAI before 4.6.78 Allowlist Bypass via find -exec | HIGH 8.7 | 0.7 % | ||
| CVE-2026-61432 | < 1.6.78 | PraisonAI FastContext before 1.6.78 Path Traversal | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-61431 | < 4.6.78 | PraisonAI before 4.6.78 Path Traversal via ContextGatherer | MEDIUM 6.8 | 0.4 % | ||
| CVE-2026-60091 | < 4.6.78 | PraisonAI before 4.6.78 Unauthenticated SSRF via webhook_url | MEDIUM 6.9 | 0.2 % | ||
| CVE-2026-60089 | < 1.6.78 | PraisonAI before 1.6.78 Path Traversal via config.toml | MEDIUM 6.9 | 0.2 % | ||
| CVE-2026-60086 | < 4.6.78 | PraisonAI before 4.6.78 Prompt Injection Defense Bypass | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-44340 | < 4.6.37 | PraisonAI: Symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir` | HIGH 8.7 | 0.4 % | ||
| CVE-2026-44339 | praisonaiagents < 1.6.37 ; praisonai < 4.6.37 | PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute | HIGH 8.6 | 0.4 % | ||
| CVE-2026-44338 | >= 2.5.6, < 4.6.34 | PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution | HIGH 7.3 | 33 % | ||
| CVE-2026-44337 | >= 2.4.1, < 4.6.34 | PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-44336 | < 4.6.34 | PraisonAI MCP `tools/call` path-traversal and RCE via Python `.pth` injection | CRITICAL 9.4 | 0.6 % | ||
| CVE-2026-44335 | < 1.6.32 | SSRF bypass in PraisonAI | HIGH 7.7 | 0.4 % | ||
| CVE-2026-44334 | >= 4.5.139, < 4.6.32 | PraisonAI: Unauthenticated RCE via `tool_override.py` | HIGH 8.4 | 0.2 % | ||
| CVE-2026-41497 | < 4.6.9 | Incomplete fix for CVE-2026-34935: Command Injection in MervinPraison/PraisonAI | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-41496 | praisonaiagents < 1.6.9 ; praisonai < 4.6.9 | PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315) | HIGH 8.1 | 0.3 % | ||
| CVE-2026-40313 | < 4.5.140 | PraisonAI: ArtiPACKED Vulnerability via GitHub Actions Credential Persistence | CRITICAL 9.1 | 0.3 % | ||
| CVE-2026-40289 | < 4.5.139 | PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions | CRITICAL 9.1 | 0.4 % | ||
| CVE-2026-40288 | < 4.5.139 | PraisonAI: Critical RCE via `type: job` workflow YAML | CRITICAL 9.8 | 0.6 % | ||
| CVE-2026-40287 | < 4.5.139 | PraisonAI has RCE via Automatic tools.py Import | HIGH 8.4 | 0.2 % | ||
| CVE-2026-40315 | < 4.5.133 | PraisonAI: SQLiteConversationStore didn't validate table_prefix when constructing SQL queries | HIGH 7.2 | 0.3 % | ||
| CVE-2026-40159 | < 4.5.128 | PraisonAI Exposes Sensitive Environment Variable via Untrusted MCP Subprocess Execution | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-40158 | < 4.5.128 | PraisonAI has Improper Control of Generation of Code ('Code Injection') and Protection Mechanism Failure in praisonai | HIGH 8.6 | 0.2 % | ||
| CVE-2026-40157 | < 4.5.128 | PraisonAI affected by arbitrary file write via path traversal in `praisonai recipe unpack` | CRITICAL 9.4 | 0.4 % | ||
| CVE-2026-40156 | < 4.5.128 | PraisonAI Affected by Implicit Execution of Arbitrary Code via Automatic `tools.py` Loading | HIGH 7.8 | 0.2 % | ||
| CVE-2026-40154 | < 4.5.128 | PraisonAI Affected by Untrusted Remote Template Code Execution | CRITICAL 9.6 | 0.3 % | ||
| CVE-2026-40151 | < 4.5.128 | PraisonAI Affected by Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOS | MEDIUM 5.3 | 0.8 % | ||
| CVE-2026-40149 | < 4.5.128 | PraisonAI has an Unauthenticated Allow-List Manipulation Bypasses Agent Tool Approval Safety Controls | HIGH 7.9 | 0.2 % | ||
| CVE-2026-40148 | < 4.5.128 | PraisonAI Affected by Decompression Bomb DoS via Recipe Bundle Extraction Without Size Limits | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-40116 | < 4.5.128 | PraisonAI's Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate Limits | HIGH 7.5 | 0.4 % | ||
| CVE-2026-40115 | < 4.5.128 | PraisonAI has an Unrestricted Upload Size in WSGI Recipe Registry Server Enables Memory Exhaustion DoS | HIGH 7.5 | 0.3 % | ||
| CVE-2026-40114 | < 4.5.128 | PraisonAI has Server-Side Request Forgery via Unvalidated webhook_url in Jobs API | CRITICAL 10.0 | 0.2 % | ||
| CVE-2026-40113 | < 4.5.128 | PraisonAI has an Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars | HIGH 8.4 | 0.2 % | ||
| CVE-2026-40112 | < 4.5.128 | PraisonAI has Stored XSS via Unsanitized Agent Output in HTML Rendering (nh3 Not a Required Dependency) | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-40088 | < 4.5.121 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai | CRITICAL 9.7 | 0.4 % | ||
| CVE-2026-39891 | < 4.5.115 | PraisonAI has a Template Injection in Agent Tool Definitions | HIGH 8.8 | 0.6 % | ||
| CVE-2026-39890 | < 4.5.115 | PraisonAI Affected by Remote Code Execution via YAML Deserialization in Agent Definition Loading | CRITICAL 9.8 | 0.6 % | ||
| CVE-2026-39889 | < 4.5.115 | PraisonAI has Unauthenticated SSE Event Stream Exposes All Agent Activity in A2U Server | HIGH 7.5 | 0.4 % | ||
| CVE-2026-39307 | < 4.5.113 | PraisonAI has an Arbitrary File Write (Zip Slip) in Templates Extraction | HIGH 8.1 | 0.3 % | ||
| CVE-2026-39308 | < 4.5.113 | PraisonAI recipe registry publish path traversal allows out-of-root file write | HIGH 7.1 | 0.3 % | ||
| CVE-2026-39306 | < 4.5.113 | PraisonAI recipe registry pull path traversal writes files outside the chosen output directory | HIGH 7.3 | 0.3 % | ||
| CVE-2026-39305 | < 4.5.113 | Arbitrary File Write / Path Traversal in Action Orchestrator | CRITICAL 10.0 | 0.3 % | ||
| CVE-2026-35615 | < 4.5.113 | PraisonAI has a Path Traversal in FileTools | CRITICAL 9.2 | 0.4 % | ||
| CVE-2026-34955 | < 4.5.97 | PraisonAI: Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandbox | CRITICAL 10.0 | 0.4 % | ||
| CVE-2026-34954 | < 1.5.95 | PraisonAI: SSRF in FileTools.download_file() via Unvalidated URL | HIGH 8.6 | 0.4 % | ||
| CVE-2026-34953 | < 4.5.97 | PraisonAI: Authentication Bypass in OAuthManager.validate_token() | CRITICAL 9.1 | 0.4 % | ||
| CVE-2026-34952 | < 4.5.97 | PraisonAI: Missing Authentication in WebSocket Gateway | CRITICAL 9.1 | 0.5 % | ||
| CVE-2026-34939 | < 4.5.90 | PraisonAI: ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools() | HIGH 7.5 | 0.4 % | ||
| CVE-2026-34938 | < 1.5.90 | PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code | CRITICAL 10.0 | 13 % | ||
| CVE-2026-34937 | < 1.5.90 | PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution | CRITICAL 9.8 | 0.6 % | ||
| CVE-2026-34936 | < 4.5.90 | PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback | HIGH 7.7 | 0.4 % | ||
| CVE-2026-34934 | < 4.5.90 | PraisonAI: Second-Order SQL Injection in `get_all_user_threads` | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-34935 | >= 4.5.15, < 4.5.69 | PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command() | CRITICAL 9.8 | 0.8 % |