HIGH7.5PyPI
GHSA-22cj-m4wf-fv2c· CVE-2026-56833, PYSEC-2026-3499PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal
Modified: 7/23/2026
package
PyPI/praisonai
pkg:pypi/praisonai
CRITICAL9.6PyPI
GHSA-2763-cj5r-c79m· CVE-2026-40088, PYSEC-2026-461PraisonAI Vulnerable to OS Command Injection
Modified: 6/29/2026
CRITICAL9.1PyPI
GHSA-29w3-p9w9-wc47· CVE-2026-57145, PYSEC-2026-3500PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation
Modified: 7/23/2026
HIGH7.8PyPI
GHSA-2g3w-cpc4-chr4· CVE-2026-40156, PYSEC-2026-2895PraisonAI Vulnerable to Implicit Execution of Arbitrary Code via Automatic `tools.py` Loading
Modified: 7/13/2026
HIGH8.2PyPI
GHSA-2gpf-2492-q9jh· CVE-2026-61435, PYSEC-2026-4247PraisonAI: Call API localhost-only authentication bypass via spoofed Host header
Modified: 10/15/2026
HIGH8.6PyPI
GHSA-2jgc-f764-c5r2· CVE-2026-55539, PYSEC-2026-3885PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete
Modified: 9/10/2026
MEDIUM6.2PyPI
GHSA-2xgv-5cv2-47vv· CVE-2026-40115, PYSEC-2026-2896PraisonAI has Unrestricted Upload Size in WSGI Recipe Registry Server that Enables Memory Exhaustion DoS
Modified: 7/13/2026
CRITICAL9.8PyPI
GHSA-32vr-5gcf-3pw2· CVE-2026-39890, PYSEC-2026-462PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading
Modified: 6/29/2026
MEDIUM6.3PyPI
GHSA-3643-7v76-5cj2· CVE-2026-44337, PYSEC-2026-2897PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries
Modified: 7/13/2026
HIGH8.6PyPI
GHSA-3c4r-6p77-xwr7· CVE-2026-40158, PYSEC-2026-2898PraisonAI Vulnerable to Code Injection and Protection Mechanism Failure
Modified: 7/13/2026
CRITICAL9.8PyPI
GHSA-4869-x4pr-q22x· CVE-2026-57125, PYSEC-2026-3501PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass
Modified: 7/23/2026
CRITICAL9.9PyPI
GHSA-4mr5-g6f9-cfrh· CVE-2026-47392, PYSEC-2026-463PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)
Modified: 6/29/2026
HIGH8.1PyPI
GHSA-4ph2-f6pf-79wv· CVE-2026-39307, PYSEC-2026-2899PraisonAI Has Arbitrary File Write (Zip Slip) in Templates Extraction
Modified: 7/13/2026
MEDIUM5.3PyPI
GHSA-4r3p-w3mc-5v34· CVE-2026-60086, PYSEC-2026-4248PraisonAI: Prompt-injection defense blocks only when 3+ detector families fire simultaneously; realistic single-vector injections pass through unblocked
Modified: 10/15/2026
HIGH7.3PyPI
GHSA-4rx4-4r3x-6534· CVE-2026-39306, PYSEC-2026-2900PraisonAI recipe registry pull path traversal writes files outside the chosen output directory
Modified: 7/13/2026
HIGH7.2PyPI
GHSA-4w49-gwv8-fpjg· CVE-2026-60091, PYSEC-2026-4249PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF
Modified: 10/15/2026
HIGH7.9PyPI
GHSA-4wr3-f4p3-5wjh· CVE-2026-40149, PYSEC-2026-2901PraisonAI: Unauthenticated Allow-List Manipulation Bypasses Agent Tool Approval Safety Controls
Modified: 7/13/2026
MEDIUM5.5PyPI
GHSA-5c6w-wwfq-7qqm· CVE-2026-47390, PYSEC-2026-2902PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings
Modified: 7/13/2026
MEDIUM5.5PyPI
GHSA-5cxw-77wg-jrf3· CVE-2026-47395, PYSEC-2026-2903PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context
Modified: 7/13/2026
HIGH8.2PyPI
GHSA-5qw8-f2g9-ff29· CVE-2026-56836, PYSEC-2026-3502PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard
Modified: 7/23/2026
HIGH8.7PyPI
GHSA-5r6c-gj4g-r697· CVE-2026-60085, PYSEC-2026-4250PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend
Modified: 10/15/2026
HIGH8.8PyPI
GHSA-63v4-w882-g4x2· CVE-2026-56840, PYSEC-2026-3503PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools
Modified: 7/23/2026
CRITICAL9.2PyPI
GHSA-693f-pf34-72c5· CVE-2026-35615, PYSEC-2026-464PraisonAI Has Path Traversal in FileTools
Modified: 6/29/2026
CRITICAL9.1PyPI
GHSA-6g6r-q6gw-w8fg· CVE-2026-55536, PYSEC-2026-3886PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)
Modified: 9/10/2026
HIGH8.8PyPI
GHSA-6jcq-6546-qrrw· CVE-2026-57144, PYSEC-2026-3504PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable
Modified: 7/23/2026
HIGH7.3PyPI
GHSA-6rmh-7xcm-cpxj· CVE-2026-44338, PYSEC-2026-2904PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution
Modified: 7/22/2026
HIGH8.1PyPI
GHSA-78r8-wwqv-r299· CVE-2026-47398, CVE-2026-64824PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334
Modified: 7/22/2026
HIGH7.8PyPI
GHSA-79fv-7hq9-w7xg· CVE-2026-61433, PYSEC-2026-4251PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source
Modified: 10/15/2026
HIGH8.6PyPI
GHSA-7c92-x8vg-4258· CVE-2026-61436, PYSEC-2026-4252PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents
Modified: 10/15/2026
HIGH7.8PyPI
GHSA-7qw2-w5rc-37x2· CVE-2026-57142, PYSEC-2026-3505PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml
Modified: 7/23/2026
HIGH8.6PyPI
GHSA-7ww9-85pg-cv4x· CVE-2026-55534, PYSEC-2026-3887PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution
Modified: 9/10/2026
CRITICAL9.8PyPI
GHSA-8444-4fhq-fxpq· CVE-2026-47393, PYSEC-2026-465PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default
Modified: 7/22/2026
HIGH8.8PyPI
GHSA-8579-rgg5-ph2m· CVE-2026-56832, PYSEC-2026-3506PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals
Modified: 7/23/2026
CRITICAL9.8PyPI
GHSA-86qc-r5v2-v6x6· CVE-2026-47396, PYSEC-2026-466PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset
Modified: 6/29/2026
CRITICAL9.8PyPI
GHSA-892r-p3jq-jp24· CVE-2026-57116, PYSEC-2026-3507PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation
Modified: 7/23/2026
HIGH8.2PyPI
GHSA-8ccj-p46r-jwqq· CVE-2026-57132, PYSEC-2026-3508PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication
Modified: 7/23/2026
HIGH7.2PyPI
GHSA-8frj-8q3m-xhgm· CVE-2026-40114, PYSEC-2026-2906PraisonAI Vulnerable to Server-Side Request Forgery via Unvalidated webhook_url in Jobs API
Modified: 7/13/2026
MEDIUM6.5PyPI
GHSA-8w9j-hc3g-3g7f· CVE-2026-34939, PYSEC-2026-2907PraisonAI Has ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools()
Modified: 7/13/2026
CRITICAL9.1PyPI
GHSA-8x8f-54wf-vv92· CVE-2026-40289, PYSEC-2026-467PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions
Modified: 6/29/2026
CRITICAL9.1PyPI
GHSA-98f9-fqg5-hvq5· CVE-2026-34953, PYSEC-2026-468PraisonAI Has Authentication Bypass via OAuthManager.validate_token()
Modified: 6/29/2026
CRITICAL9.4PyPI
GHSA-99g3-w8gr-x37c· CVE-2026-40157, PYSEC-2026-469PraisonAI vulnerable to arbitrary file write via path traversal in `praisonai recipe unpack`
Modified: 6/29/2026
CRITICAL9.8PyPI
GHSA-9cq8-3v94-434g· CVE-2026-34934, PYSEC-2026-470PraisonAI Has Second-Order SQL Injection in `get_all_user_threads`
Modified: 6/29/2026
HIGH8.7PyPI
GHSA-9cr9-25q5-8prj· CVE-2026-47394, PYSEC-2026-2908PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate
Modified: 7/13/2026
CRITICAL9.8PyPI
GHSA-9gm9-c8mq-vq7m· CVE-2026-34935, PYSEC-2026-471PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()
Modified: 6/29/2026
CRITICAL9.9PyPI
GHSA-9mp3-24cc-77mg· CVE-2026-61445, PYSEC-2026-4253PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls
Modified: 10/15/2026
CRITICAL9.6PyPI
GHSA-9mqq-jqxf-grvw· CVE-2026-44336, PYSEC-2026-472PraisonAI MCP `tools/call` path-traversal => RCE via Python `.pth` injection
Modified: 6/29/2026
HIGH7.5PyPI
GHSA-9q28-ghcr-c4x3· CVE-2026-44340, PYSEC-2026-2909PraisonAI's symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`
Modified: 7/13/2026
CRITICAL9.8PyPI
GHSA-9qhq-v63v-fv3j· CVE-2026-41497, PYSEC-2026-473PraisonAI has an incomplete fix for CVE-2026-34935 - OS Command Injection
Modified: 6/29/2026
MEDIUM5.4PyPI
GHSA-cfg2-mxfj-j6pw· CVE-2026-40112, PYSEC-2026-2910PraisonAI Vulnerable to Stored XSS via Unsanitized Agent Output in HTML Rendering (nh3 Not a Required Dependency)
Modified: 7/13/2026
CRITICAL9.1PyPI
GHSA-cfh6-vr3j-qc3g· CVE-2026-34952, PYSEC-2026-474PraisonAI Has Missing Authentication in WebSocket Gateway
Modified: 6/29/2026
HIGH7.1PyPI
GHSA-ch89-h4r2-c8f8· CVE-2026-55540, PYSEC-2026-3888PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks
Modified: 9/10/2026
HIGH8.8PyPI
GHSA-cv3g-hj65-pcfh· CVE-2026-61434, PYSEC-2026-4254PraisonAI: Shell command allowlist bypass via find -exec built-in action
Modified: 10/15/2026
HIGH7.5PyPI
GHSA-f292-66h9-fpmf· CVE-2026-39889, PYSEC-2026-2911PraisonAI Has Unauthenticated SSE Event Stream that Exposes All Agent Activity in A2U Server
Modified: 7/13/2026
MEDIUM6.5PyPI
GHSA-f2h6-7xfr-xm8w· CVE-2026-40148, PYSEC-2026-2912PraisonAI Vulnerable to Decompression Bomb DoS via Recipe Bundle Extraction Without Size Limits
Modified: 7/13/2026
HIGH8.1PyPI
GHSA-f44v-7qgw-9gh9· CVE-2026-57113, PYSEC-2026-3509PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion
Modified: 7/23/2026
HIGH8.6PyPI
GHSA-fc26-m9pf-v56q· CVE-2026-56837, PYSEC-2026-3510PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing
Modified: 7/23/2026
HIGH7.5PyPI
GHSA-fj8f-m44g-c479· CVE-2026-61439, PYSEC-2026-4255PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats
Modified: 10/15/2026
CRITICAL9.8PyPI
GHSA-fq2m-6wqh-x44g· CVE-2026-57131, PYSEC-2026-3511PraisonAI: Jobs API exposes agent-execution endpoints with no authentication
Modified: 7/23/2026
HIGH8.4PyPI
GHSA-fvxx-ggmx-3cjg· CVE-2026-40113, PYSEC-2026-2913PraisonAI Vulnerable to Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars
Modified: 7/13/2026
CRITICAL9.1PyPI
GHSA-g6j7-pffp-8whg· CVE-2026-61444, CVE-2026-62176PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation
Modified: 10/15/2026
HIGH8.4PyPI
GHSA-g985-wjh9-qxxc· CVE-2026-40287, PYSEC-2026-2914PraisonAI Vulnerable to RCE via Automatic tools.py Import
Modified: 7/13/2026
HIGH7.3PyPI
GHSA-gcq3-mfvh-3x25· CVE-2026-56839, PYSEC-2026-3512PraisonAI Code agent tools fail open without a workspace boundary
Modified: 7/23/2026
HIGH8.2PyPI
GHSA-gfq8-hmph-9gjv· CVE-2026-55533, PYSEC-2026-3889PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret
Modified: 9/10/2026
HIGH8.6PyPI
GHSA-gmjg-hv98-qggq· CVE-2026-44339, PYSEC-2026-2915PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute
Modified: 7/13/2026
HIGH7.3PyPI
GHSA-hc5v-gxvj-58wh· CVE-2026-61427, PYSEC-2026-4257PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface
Modified: 10/15/2026
MEDIUM6.8PyPI
GHSA-hmfx-4v44-9qw9· CVE-2026-55535, PYSEC-2026-3890PraisonAI vulnerable to Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation
Modified: 9/10/2026
HIGH7.1PyPI
GHSA-hvhp-v2gc-268q· CVE-2026-47397, PYSEC-2026-2916PraisonAI has an Arbitrary File Write in Python API
Modified: 7/13/2026
HIGH8.8PyPI
GHSA-hwg5-x759-7wjg· CVE-2026-39891, PYSEC-2026-2917PraisonAI has Template Injection in Agent Tool Definitions
Modified: 7/13/2026
HIGH7.8PyPI
GHSA-hxmv-c4g6-5fqc· CVE-2026-55522, PYSEC-2026-3891PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code
Modified: 9/10/2026
CRITICAL9.8PyPI
GHSA-j4hj-7hfh-g2f4· CVE-2026-57127, PYSEC-2026-3513praisonai: recipe serve auth middleware silently disables itself when no secret is set
Modified: 7/23/2026
HIGH7.5PyPI
GHSA-j7qx-p75m-wp7g· CVE-2026-56834, PYSEC-2026-3514PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage
Modified: 7/23/2026
CRITICAL9.0PyPI
GHSA-jfxc-v5g9-38xr· CVE-2026-39305, PYSEC-2026-475PraisonAI Vulnerable to Arbitrary File Write / Path Traversal in Action Orchestrator
Modified: 6/29/2026
HIGH7.5PyPI
GHSA-jxcw-qp4h-6jfq· CVE-2026-57146, PYSEC-2026-3515PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default
Modified: 7/23/2026
HIGH7.5PyPI
GHSA-p4pj-vh7h-6cqh· CVE-2026-57119, PYSEC-2026-3516PraisonAI: Unauthenticated Local File Inclusion via agent_file path in PraisonAI Jobs API
Modified: 7/23/2026
CRITICAL9.8PyPI
GHSA-p75f-6fp4-p57w· CVE-2026-57124, PYSEC-2026-3517PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai
Modified: 7/23/2026
MEDIUM5.5PyPI
GHSA-pj2r-f9mw-vrcq· CVE-2026-40159, PYSEC-2026-2918PraisonAI Vulnerable to Sensitive Environment Variable Exposure via Untrusted MCP Subprocess Execution
Modified: 7/13/2026
MEDIUM5.3PyPI
GHSA-pm96-6xpr-978x· CVE-2026-40151, PYSEC-2026-2919PraisonAI: Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOS
Modified: 7/13/2026
CRITICAL9.3PyPI
GHSA-pv9q-275h-rh7x· CVE-2026-40154, PYSEC-2026-476PraisonAI Vulnerable Untrusted Remote Template Code Execution
Modified: 6/29/2026
HIGH7.6PyPI
GHSA-pvph-5j39-v8qc· CVE-2026-55532, PYSEC-2026-3892PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server
Modified: 9/10/2026
HIGH8.8PyPI
GHSA-pvxx-r596-f5qj· CVE-2026-55541, PYSEC-2026-3893PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-q5r4-47m9-5mc7· CVE-2026-40116, PYSEC-2026-2920PraisonAI: Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate Limits
Modified: 7/13/2026
MEDIUM5.5PyPI
GHSA-q7m5-3jmv-vm48· CVE-2026-61431, PYSEC-2026-4258PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace
Modified: 10/15/2026
HIGH7.3PyPI
GHSA-qj9c-59p6-8cgx· CVE-2026-61428, PYSEC-2026-4259PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing
Modified: 10/15/2026
HIGH8.3PyPI
GHSA-qvpf-j64c-jmhr· CVE-2026-56835, PYSEC-2026-3518PraisonAI Slack app_mention bypasses configured user/channel authorization
Modified: 7/23/2026
HIGH8.8PyPI
GHSA-qwgj-rrpj-75xm· CVE-2026-56075PraisonAI: Hardcoded `approval_mode="auto"` in Chainlit UI Overrides Administrator Configuration, Enabling Unapproved Shell Command Execution
Modified: 7/8/2026
HIGH8.8PyPI
GHSA-r4f2-3m54-pp7q· CVE-2026-34955, PYSEC-2026-2921PraisonAI Has Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandbox
Modified: 7/13/2026
HIGH7.3PyPI
GHSA-r7v3-x45f-g7hp· CVE-2026-55538, PYSEC-2026-3894PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated
Modified: 9/10/2026
HIGH7.1PyPI
GHSA-r9x3-wx45-2v7f· CVE-2026-39308, PYSEC-2026-2922PraisonAI recipe registry publish path traversal allows out-of-root file write
Modified: 7/13/2026
HIGH8.1PyPI
GHSA-rg3h-x3jw-7jm5· CVE-2026-41496, PYSEC-2026-2923PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)
Modified: 7/13/2026
HIGH7.1PyPI
GHSA-rg5q-pp8p-f7jm· CVE-2026-55537, PYSEC-2026-3895PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114
Modified: 9/10/2026
HIGH7.2PyPI
GHSA-rjvw-7vvw-549v· CVE-2026-57114, PYSEC-2026-3519PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding
Modified: 7/23/2026
HIGH7.8PyPI
GHSA-v847-hxxw-3pxg· CVE-2026-56838, PYSEC-2026-3520PraisonAI recipe.run_stream skips dangerous-tool policy enforcement
Modified: 7/23/2026
CRITICAL9.8PyPI
GHSA-vc46-vw85-3wvm· CVE-2026-40288, PYSEC-2026-477PraisonAI has critical RCE via `type: job` workflow YAML
Modified: 6/29/2026
CRITICAL9.8PyPI
GHSA-vg22-4gmj-prxw· CVE-2026-47391, PYSEC-2026-478PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution
Modified: 6/29/2026
HIGH8.3PyPI
GHSA-vmf9-xx9w-86wx· CVE-2026-57112, PYSEC-2026-3521PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools
Modified: 7/23/2026
HIGH8.8PyPI
GHSA-w6h2-fr4q-xvxv· CVE-2026-57117, PYSEC-2026-3522PraisonAI: Compute-bridged file tools allow shell command injection
Modified: 7/23/2026
MEDIUMPyPI
GHSA-wf65-4jjx-q444· CVE-2026-60090, PYSEC-2026-4260PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL
Modified: 10/15/2026
MEDIUM6.9PyPI
GHSA-wj6g-v78p-6fx3· CVE-2026-55529, PYSEC-2026-3896PraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local MCP server
Modified: 9/10/2026
MEDIUM6.5PyPI
GHSA-wv94-5qcp-6m36· CVE-2026-55531, PYSEC-2026-3897PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced)
Modified: 9/10/2026
HIGH7.7PyPI
GHSA-x6m9-gxvr-7jpv· CVE-2026-34936, PYSEC-2026-2924PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback
Modified: 7/13/2026
MEDIUM6.9PyPI
GHSA-x783-xp3g-mqhp· CVE-2026-40315, PYSEC-2026-2925PraisonAI: SQLiteConversationStore didn't validate table_prefix when constructing SQL queries
Modified: 7/13/2026
HIGH8.6PyPI
GHSA-x92v-rpx6-p6cw· CVE-2026-57122, PYSEC-2026-3523PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)
Modified: 7/23/2026
HIGH8.4PyPI
GHSA-xcmw-grxf-wjhj· CVE-2026-44334, PYSEC-2026-2926PraisonAI has unauthenticated RCE via `tool_override.py` (CVE-2026-40287 patch bypass)
Modified: 7/13/2026
MEDIUM5.5PyPI
GHSA-xpx6-x8c2-mw5w· CVE-2026-60088, PYSEC-2026-4261PraisonAI: Project custom command templates can read outside-workspace files into model prompts
Modified: 10/15/2026
HIGH7.8PyPI
PYSEC-2026-2895· CVE-2026-40156, GHSA-2g3w-cpc4-chr4PraisonAI Vulnerable to Implicit Execution of Arbitrary Code via Automatic `tools.py` Loading
Modified: 7/13/2026
MEDIUM6.2PyPI
PYSEC-2026-2896· CVE-2026-40115, GHSA-2xgv-5cv2-47vvPraisonAI has Unrestricted Upload Size in WSGI Recipe Registry Server that Enables Memory Exhaustion DoS
Modified: 7/13/2026
MEDIUM6.3PyPI
PYSEC-2026-2897· CVE-2026-44337, GHSA-3643-7v76-5cj2PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries
Modified: 7/13/2026
HIGH8.6PyPI
PYSEC-2026-2898· CVE-2026-40158, GHSA-3c4r-6p77-xwr7PraisonAI Vulnerable to Code Injection and Protection Mechanism Failure
Modified: 7/13/2026
HIGH8.1PyPI
PYSEC-2026-2899· CVE-2026-39307, GHSA-4ph2-f6pf-79wvPraisonAI Has Arbitrary File Write (Zip Slip) in Templates Extraction
Modified: 7/13/2026
HIGH7.3PyPI
PYSEC-2026-2900· CVE-2026-39306, GHSA-4rx4-4r3x-6534PraisonAI recipe registry pull path traversal writes files outside the chosen output directory
Modified: 7/13/2026
HIGH7.9PyPI
PYSEC-2026-2901· CVE-2026-40149, GHSA-4wr3-f4p3-5wjhPraisonAI: Unauthenticated Allow-List Manipulation Bypasses Agent Tool Approval Safety Controls
Modified: 7/13/2026
MEDIUM5.5PyPI
PYSEC-2026-2902· CVE-2026-47390, GHSA-5c6w-wwfq-7qqmPraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings
Modified: 7/13/2026
MEDIUM5.5PyPI
PYSEC-2026-2903· CVE-2026-47395, GHSA-5cxw-77wg-jrf3PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context
Modified: 7/13/2026
HIGH7.3PyPI
PYSEC-2026-2904· CVE-2026-44338, GHSA-6rmh-7xcm-cpxjPraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution
Modified: 7/13/2026
HIGH8.1PyPI
PYSEC-2026-2905· CVE-2026-47398, CVE-2026-64824PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334
Modified: 7/22/2026
HIGH7.2PyPI
PYSEC-2026-2906· CVE-2026-40114, GHSA-8frj-8q3m-xhgmPraisonAI Vulnerable to Server-Side Request Forgery via Unvalidated webhook_url in Jobs API
Modified: 7/13/2026
MEDIUM6.5PyPI
PYSEC-2026-2907· CVE-2026-34939, GHSA-8w9j-hc3g-3g7fPraisonAI Has ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools()
Modified: 7/13/2026
HIGH8.7PyPI
PYSEC-2026-2908· CVE-2026-47394, GHSA-9cr9-25q5-8prjPraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate
Modified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-2909· CVE-2026-44340, GHSA-9q28-ghcr-c4x3PraisonAI's symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`
Modified: 7/13/2026
MEDIUM5.4PyPI
PYSEC-2026-2910· CVE-2026-40112, GHSA-cfg2-mxfj-j6pwPraisonAI Vulnerable to Stored XSS via Unsanitized Agent Output in HTML Rendering (nh3 Not a Required Dependency)
Modified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-2911· CVE-2026-39889, GHSA-f292-66h9-fpmfPraisonAI Has Unauthenticated SSE Event Stream that Exposes All Agent Activity in A2U Server
Modified: 7/13/2026
MEDIUM6.5PyPI
PYSEC-2026-2912· CVE-2026-40148, GHSA-f2h6-7xfr-xm8wPraisonAI Vulnerable to Decompression Bomb DoS via Recipe Bundle Extraction Without Size Limits
Modified: 7/13/2026
HIGH8.4PyPI
PYSEC-2026-2913· CVE-2026-40113, GHSA-fvxx-ggmx-3cjgPraisonAI Vulnerable to Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars
Modified: 7/13/2026
HIGH8.4PyPI
PYSEC-2026-2914· CVE-2026-40287, GHSA-g985-wjh9-qxxcPraisonAI Vulnerable to RCE via Automatic tools.py Import
Modified: 7/13/2026
HIGH8.6PyPI
PYSEC-2026-2915· CVE-2026-44339, GHSA-gmjg-hv98-qggqPraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute
Modified: 7/13/2026
HIGH7.1PyPI
PYSEC-2026-2916· CVE-2026-47397, GHSA-hvhp-v2gc-268qPraisonAI has an Arbitrary File Write in Python API
Modified: 7/13/2026
HIGH8.8PyPI
PYSEC-2026-2917· CVE-2026-39891, GHSA-hwg5-x759-7wjgPraisonAI has Template Injection in Agent Tool Definitions
Modified: 7/13/2026
MEDIUM5.5PyPI
PYSEC-2026-2918· CVE-2026-40159, GHSA-pj2r-f9mw-vrcqPraisonAI Vulnerable to Sensitive Environment Variable Exposure via Untrusted MCP Subprocess Execution
Modified: 7/13/2026
MEDIUM5.3PyPI
PYSEC-2026-2919· CVE-2026-40151, GHSA-pm96-6xpr-978xPraisonAI: Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOS
Modified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-2920· CVE-2026-40116, GHSA-q5r4-47m9-5mc7PraisonAI: Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate Limits
Modified: 7/13/2026
HIGH8.8PyPI
PYSEC-2026-2921· CVE-2026-34955, GHSA-r4f2-3m54-pp7qPraisonAI Has Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandbox
Modified: 7/13/2026
HIGH7.1PyPI
PYSEC-2026-2922· CVE-2026-39308, GHSA-r9x3-wx45-2v7fPraisonAI recipe registry publish path traversal allows out-of-root file write
Modified: 7/13/2026
HIGH8.1PyPI
PYSEC-2026-2923· CVE-2026-41496, GHSA-rg3h-x3jw-7jm5PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)
Modified: 7/13/2026
HIGH7.7PyPI
PYSEC-2026-2924· CVE-2026-34936, GHSA-x6m9-gxvr-7jpvPraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback
Modified: 7/13/2026
MEDIUM6.9PyPI
PYSEC-2026-2925· CVE-2026-40315, GHSA-x783-xp3g-mqhpPraisonAI: SQLiteConversationStore didn't validate table_prefix when constructing SQL queries
Modified: 7/13/2026
HIGH8.4PyPI
PYSEC-2026-2926· CVE-2026-44334, GHSA-xcmw-grxf-wjhjPraisonAI has unauthenticated RCE via `tool_override.py` (CVE-2026-40287 patch bypass)
Modified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-3499· CVE-2026-56833, GHSA-22cj-m4wf-fv2cPraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal
Modified: 7/23/2026
CRITICAL9.1PyPI
PYSEC-2026-3500· CVE-2026-57145, GHSA-29w3-p9w9-wc47PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation
Modified: 7/23/2026
CRITICAL9.8PyPI
PYSEC-2026-3501· CVE-2026-57125, GHSA-4869-x4pr-q22xPraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass
Modified: 7/23/2026
HIGH8.2PyPI
PYSEC-2026-3502· CVE-2026-56836, GHSA-5qw8-f2g9-ff29PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard
Modified: 7/23/2026
HIGH8.8PyPI
PYSEC-2026-3503· CVE-2026-56840, GHSA-63v4-w882-g4x2PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools
Modified: 7/23/2026
HIGH8.8PyPI
PYSEC-2026-3504· CVE-2026-57144, GHSA-6jcq-6546-qrrwPraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable
Modified: 7/23/2026
HIGH7.8PyPI
PYSEC-2026-3505· CVE-2026-57142, GHSA-7qw2-w5rc-37x2PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml
Modified: 7/23/2026
HIGH8.8PyPI
PYSEC-2026-3506· CVE-2026-56832, GHSA-8579-rgg5-ph2mPraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals
Modified: 7/23/2026
CRITICAL9.8PyPI
PYSEC-2026-3507· CVE-2026-57116, GHSA-892r-p3jq-jp24PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation
Modified: 7/23/2026
HIGH8.2PyPI
PYSEC-2026-3508· CVE-2026-57132, GHSA-8ccj-p46r-jwqqPraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication
Modified: 7/23/2026
HIGH8.1PyPI
PYSEC-2026-3509· CVE-2026-57113, GHSA-f44v-7qgw-9gh9PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion
Modified: 7/23/2026
HIGH8.6PyPI
PYSEC-2026-3510· CVE-2026-56837, GHSA-fc26-m9pf-v56qPraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing
Modified: 7/23/2026
CRITICAL9.8PyPI
PYSEC-2026-3511· CVE-2026-57131, GHSA-fq2m-6wqh-x44gPraisonAI: Jobs API exposes agent-execution endpoints with no authentication
Modified: 7/23/2026
HIGH7.3PyPI
PYSEC-2026-3512· CVE-2026-56839, GHSA-gcq3-mfvh-3x25PraisonAI Code agent tools fail open without a workspace boundary
Modified: 7/23/2026
CRITICAL9.8PyPI
PYSEC-2026-3513· CVE-2026-57127, GHSA-j4hj-7hfh-g2f4praisonai: recipe serve auth middleware silently disables itself when no secret is set
Modified: 7/23/2026
HIGH7.5PyPI
PYSEC-2026-3514· CVE-2026-56834, GHSA-j7qx-p75m-wp7gPraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage
Modified: 7/23/2026
HIGH7.5PyPI
PYSEC-2026-3515· CVE-2026-57146, GHSA-jxcw-qp4h-6jfqPraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default
Modified: 7/23/2026
HIGH7.5PyPI
PYSEC-2026-3516· CVE-2026-57119, GHSA-p4pj-vh7h-6cqhPraisonAI: Unauthenticated Local File Inclusion via agent_file path in PraisonAI Jobs API
Modified: 7/23/2026
CRITICAL9.8PyPI
PYSEC-2026-3517· CVE-2026-57124, GHSA-p75f-6fp4-p57wPraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai
Modified: 7/23/2026
HIGH8.3PyPI
PYSEC-2026-3518· CVE-2026-56835, GHSA-qvpf-j64c-jmhrPraisonAI Slack app_mention bypasses configured user/channel authorization
Modified: 7/23/2026
HIGH7.2PyPI
PYSEC-2026-3519· CVE-2026-57114, GHSA-rjvw-7vvw-549vPraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding
Modified: 7/23/2026
HIGH7.8PyPI
PYSEC-2026-3520· CVE-2026-56838, GHSA-v847-hxxw-3pxgPraisonAI recipe.run_stream skips dangerous-tool policy enforcement
Modified: 7/23/2026
HIGH8.3PyPI
PYSEC-2026-3521· CVE-2026-57112, GHSA-vmf9-xx9w-86wxPraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools
Modified: 7/23/2026
HIGH8.8PyPI
PYSEC-2026-3522· CVE-2026-57117, GHSA-w6h2-fr4q-xvxvPraisonAI: Compute-bridged file tools allow shell command injection
Modified: 7/23/2026
HIGH8.6PyPI
PYSEC-2026-3523· CVE-2026-57122, GHSA-x92v-rpx6-p6cwPraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)
Modified: 7/23/2026
HIGH8.6PyPI
PYSEC-2026-3885· CVE-2026-55539, GHSA-2jgc-f764-c5r2PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete
Modified: 9/10/2026
CRITICAL9.1PyPI
PYSEC-2026-3886· CVE-2026-55536, GHSA-6g6r-q6gw-w8fgPraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)
Modified: 9/10/2026
HIGH8.6PyPI
PYSEC-2026-3887· CVE-2026-55534, GHSA-7ww9-85pg-cv4xPraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution
Modified: 9/10/2026
HIGH7.1PyPI
PYSEC-2026-3888· CVE-2026-55540, GHSA-ch89-h4r2-c8f8PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks
Modified: 9/10/2026
HIGH8.2PyPI
PYSEC-2026-3889· CVE-2026-55533, GHSA-gfq8-hmph-9gjvPraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret
Modified: 9/10/2026
MEDIUM6.8PyPI
PYSEC-2026-3890· CVE-2026-55535, GHSA-hmfx-4v44-9qw9PraisonAI vulnerable to Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation
Modified: 9/10/2026
HIGH7.8PyPI
PYSEC-2026-3891· CVE-2026-55522, GHSA-hxmv-c4g6-5fqcPraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code
Modified: 9/10/2026
HIGH7.6PyPI
PYSEC-2026-3892· CVE-2026-55532, GHSA-pvph-5j39-v8qcPraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server
Modified: 9/10/2026
HIGH8.8PyPI
PYSEC-2026-3893· CVE-2026-55541, GHSA-pvxx-r596-f5qjPraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced
Modified: 9/10/2026
HIGH7.3PyPI
PYSEC-2026-3894· CVE-2026-55538, GHSA-r7v3-x45f-g7hpPraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated
Modified: 9/10/2026
HIGH7.1PyPI
PYSEC-2026-3895· CVE-2026-55537, GHSA-rg5q-pp8p-f7jmPraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114
Modified: 9/10/2026
MEDIUM6.9PyPI
PYSEC-2026-3896· CVE-2026-55529, GHSA-wj6g-v78p-6fx3PraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local MCP server
Modified: 9/10/2026
MEDIUM6.5PyPI
PYSEC-2026-3897· CVE-2026-55531, GHSA-wv94-5qcp-6m36PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced)
Modified: 9/10/2026
HIGH8.2PyPI
PYSEC-2026-4247· CVE-2026-61435, GHSA-2gpf-2492-q9jhPraisonAI: Call API localhost-only authentication bypass via spoofed Host header
Modified: 10/15/2026
MEDIUM5.3PyPI
PYSEC-2026-4248· CVE-2026-60086, GHSA-4r3p-w3mc-5v34PraisonAI: Prompt-injection defense blocks only when 3+ detector families fire simultaneously; realistic single-vector injections pass through unblocked
Modified: 10/15/2026
HIGH7.2PyPI
PYSEC-2026-4249· CVE-2026-60091, GHSA-4w49-gwv8-fpjgPraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF
Modified: 10/15/2026
HIGH8.7PyPI
PYSEC-2026-4250· CVE-2026-60085, GHSA-5r6c-gj4g-r697PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend
Modified: 10/15/2026
HIGH7.8PyPI
PYSEC-2026-4251· CVE-2026-61433, GHSA-79fv-7hq9-w7xgPraisonAI: API deploy code generator embeds unescaped YAML fields into Python source
Modified: 10/15/2026
HIGH8.6PyPI
PYSEC-2026-4252· CVE-2026-61436, GHSA-7c92-x8vg-4258PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents
Modified: 10/15/2026
CRITICAL9.9PyPI
PYSEC-2026-4253· CVE-2026-61445, GHSA-9mp3-24cc-77mgPraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls
Modified: 10/15/2026
HIGH8.8PyPI
PYSEC-2026-4254· CVE-2026-61434, GHSA-cv3g-hj65-pcfhPraisonAI: Shell command allowlist bypass via find -exec built-in action
Modified: 10/15/2026
HIGH7.5PyPI
PYSEC-2026-4255· CVE-2026-61439, GHSA-fj8f-m44g-c479PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats
Modified: 10/15/2026
CRITICAL9.1PyPI
PYSEC-2026-4256· CVE-2026-61444, CVE-2026-62176PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation
Modified: 10/15/2026
HIGH7.3PyPI
PYSEC-2026-4257· CVE-2026-61427, GHSA-hc5v-gxvj-58whPraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface
Modified: 10/15/2026
MEDIUM5.5PyPI
PYSEC-2026-4258· CVE-2026-61431, GHSA-q7m5-3jmv-vm48PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace
Modified: 10/15/2026
HIGH7.3PyPI
PYSEC-2026-4259· CVE-2026-61428, GHSA-qj9c-59p6-8cgxPraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing
Modified: 10/15/2026
CRITICAL9.8PyPI
PYSEC-2026-4260· CVE-2026-60090, GHSA-wf65-4jjx-q444PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL
Modified: 10/15/2026
MEDIUM5.5PyPI
PYSEC-2026-4261· CVE-2026-60088, GHSA-xpx6-x8c2-mw5wPraisonAI: Project custom command templates can read outside-workspace files into model prompts
Modified: 10/15/2026
CRITICAL9.6PyPI
PYSEC-2026-461· CVE-2026-40088, GHSA-2763-cj5r-c79mPraisonAI Vulnerable to OS Command Injection
Modified: 7/2/2026
CRITICAL9.8PyPI
PYSEC-2026-462· CVE-2026-39890, GHSA-32vr-5gcf-3pw2PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading
Modified: 7/13/2026
CRITICAL9.9PyPI
PYSEC-2026-463· CVE-2026-47392, GHSA-4mr5-g6f9-cfrhPraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)
Modified: 7/13/2026
CRITICAL9.2PyPI
PYSEC-2026-464· CVE-2026-35615, GHSA-693f-pf34-72c5PraisonAI Has Path Traversal in FileTools
Modified: 7/13/2026
CRITICAL9.8PyPI
PYSEC-2026-465· CVE-2026-47393, GHSA-8444-4fhq-fxpqPraisonAI `deploy --type api` emits a Flask server with authentication disabled by default
Modified: 7/13/2026
CRITICAL9.8PyPI
PYSEC-2026-466· CVE-2026-47396, GHSA-86qc-r5v2-v6x6PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset
Modified: 7/13/2026
CRITICAL9.1PyPI
PYSEC-2026-467· CVE-2026-40289, GHSA-8x8f-54wf-vv92PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions
Modified: 7/13/2026
CRITICAL9.1PyPI
PYSEC-2026-468· CVE-2026-34953, GHSA-98f9-fqg5-hvq5PraisonAI Has Authentication Bypass via OAuthManager.validate_token()
Modified: 7/13/2026
CRITICAL9.4PyPI
PYSEC-2026-469· CVE-2026-40157, GHSA-99g3-w8gr-x37cPraisonAI vulnerable to arbitrary file write via path traversal in `praisonai recipe unpack`
Modified: 7/1/2026
CRITICAL9.8PyPI
PYSEC-2026-470· CVE-2026-34934, GHSA-9cq8-3v94-434gPraisonAI Has Second-Order SQL Injection in `get_all_user_threads`
Modified: 7/13/2026
CRITICAL9.8PyPI
PYSEC-2026-471· CVE-2026-34935, GHSA-9gm9-c8mq-vq7mPraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()
Modified: 7/13/2026
CRITICAL9.6PyPI
PYSEC-2026-472· CVE-2026-44336, GHSA-9mqq-jqxf-grvwPraisonAI MCP `tools/call` path-traversal => RCE via Python `.pth` injection
Modified: 7/13/2026
CRITICAL9.8PyPI
PYSEC-2026-473· CVE-2026-41497, GHSA-9qhq-v63v-fv3jPraisonAI has an incomplete fix for CVE-2026-34935 - OS Command Injection
Modified: 7/13/2026
CRITICAL9.1PyPI
PYSEC-2026-474· CVE-2026-34952, GHSA-cfh6-vr3j-qc3gPraisonAI Has Missing Authentication in WebSocket Gateway
Modified: 7/13/2026
CRITICAL9.0PyPI
PYSEC-2026-475· CVE-2026-39305, GHSA-jfxc-v5g9-38xrPraisonAI Vulnerable to Arbitrary File Write / Path Traversal in Action Orchestrator
Modified: 7/13/2026
CRITICAL9.3PyPI
PYSEC-2026-476· CVE-2026-40154, GHSA-pv9q-275h-rh7xPraisonAI Vulnerable Untrusted Remote Template Code Execution
Modified: 7/1/2026
CRITICAL9.8PyPI
PYSEC-2026-477· CVE-2026-40288, GHSA-vc46-vw85-3wvmPraisonAI has critical RCE via `type: job` workflow YAML
Modified: 7/13/2026
CRITICAL9.8PyPI
PYSEC-2026-478· CVE-2026-47391, GHSA-vg22-4gmj-prxwPraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution
Modified: 7/13/2026