{"kind": "product", "path": "vulns/pypi/praisonai", "name": "praisonai", "product": "praisonai", "ecosystem": "PyPI", "items": [{"id": "CVE-2026-57117", "noindex": false, "published": "2026-10-23T12:10:18.920Z", "modified": "2026-10-23T12:10:18.920Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00401, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-57117", "title": "PraisonAI: Compute-bridged file tools allow shell command injection", "description": "PraisonAI is a multi-agent teams system. From version 4.6.10 to before version 4.6.59, LocalManagedAgent / SandboxedAgent compute bridging wraps read_file, list_files, and write_file when a compute provider is attached. The bridge converts those file operations into shell command strings using raw path arguments, then sends those strings to shell-backed compute providers. An attacker who can influence a file-tool path argument can break out of the quoted path and execute arbitrary shell commands in the compute environment. With compute=\"local\", commands execute through the local subprocess compute provider on the host. With Docker, commands e", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-w6h2-fr4q-xvxv", "https://nvd.nist.gov/vuln/detail/CVE-2026-57117"], "fixes": ["4.6.59"], "products": [{"name": "praisonai", "path": "vulns/pypi/praisonai", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-57146", "noindex": false, "published": "2026-10-23T12:08:16.479Z", "modified": "2026-10-23T12:08:16.479Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.00343, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-57146", "title": "PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default", "description": "PraisonAI is a multi-agent teams system. From version 4.5.115 to before version 4.6.61, the published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint. The current CLI wrapper does not expose --api-key, does not install the common API-key middleware, and does not generate a token for A2U. It calls create_a2u_routes(app) directly. That helper only enforces auth if A2U_AUTH_TOKEN is already present; if the variable is missing, _authenticate_re", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-jxcw-qp4h-6jfq", "https://nvd.nist.gov/vuln/detail/CVE-2026-57146"], "fixes": ["4.6.61"], "products": [{"name": "praisonai", "path": "vulns/pypi/praisonai", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-57144", "noindex": false, "published": "2026-10-23T12:07:55.583Z", "modified": "2026-10-23T12:07:55.583Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "severity": "high", "epss": 0.00123, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-57144", "title": "PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable", "description": "PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native() path lets callers configure allowed filesystem paths and network=False. On systems where the optional sandlock module imports but reports that Landlock is unavailable, SandlockSandbox.execute() and run_command() do not fail closed. They silently fall back to SubprocessSandbox(self.config). That fallback keeps the same high-level native policy object but does not enforce the native filesystem or network bounda", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6jcq-6546-qrrw", "https://nvd.nist.gov/vuln/detail/CVE-2026-57144"], "fixes": ["4.6.61"], "products": [{"name": "praisonai", "path": "vulns/pypi/praisonai", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-57142", "noindex": false, "published": "2026-10-23T12:07:46.547Z", "modified": "2026-10-23T12:07:46.547Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00146, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-57142", "title": "PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml", "description": "PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.61, PraisonAI recipe execution has a dangerous-tool policy that is supposed to block default-denied tools unless the caller explicitly passes allow_dangerous_tools=True. That policy only checks tools declared in TEMPLATE.yaml requires.tools. For steps-based recipes, the actual execution path loads workflow.yaml with YAMLWorkflowParser. That parser resolves agent-level tools: declarations and preserves top-level approve:. Workflow.start() then installs those YAML-approved tools into the approval context. As a result, an untrusted recipe can omit execute_command ", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-7qw2-w5rc-37x2", "https://nvd.nist.gov/vuln/detail/CVE-2026-57142"], "fixes": ["4.6.61"], "products": [{"name": "praisonai", "path": "vulns/pypi/praisonai", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-57116", "noindex": false, "published": "2026-10-23T12:06:55.544Z", "modified": "2026-10-23T12:06:55.544Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.00273, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-57116", "title": "PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation", "description": "PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm96-6xpr-978x / CVE-2026-40151. The chat route directly calls agent.chat(request.message). No-auth and wrong-bearer requests both execute the deployed agent. This is broader than passive metadata disclosure. In any deployment where AgentOS wraps agents with tools, private context, memory, API integrations, or cost-bearing model calls, an unauthenticated reachable client can drive those agents. This issue has bee", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-892r-p3jq-jp24", "https://nvd.nist.gov/vuln/detail/CVE-2026-57116"], "fixes": ["4.6.59"], "products": [{"name": "praisonai", "path": "vulns/pypi/praisonai", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-57114", "noindex": false, "published": "2026-10-23T12:04:29.966Z", "modified": "2026-10-23T12:04:29.966Z", "cvss": 7.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "severity": "high", "epss": 0.00187, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-57114", "title": "PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding", "description": "PraisonAI is a multi-agent teams system. From version 4.5.126 to before version 4.6.59, PraisonAI's Async Jobs API validates webhook_url when a job request is parsed and again when the internal Job object is constructed. That validation blocks direct loopback/private targets, but it is not bound to the later network request. When a job completes, _send_webhook() passes the original hostname to httpx.AsyncClient.post() with no send-time validation, IP pinning, or guarded transport. An attacker-controlled hostname can therefore resolve to a public IP during Pydantic validation and later resolve to loopback/private/cloud-metadata infrastructure ", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rjvw-7vvw-549v", "https://nvd.nist.gov/vuln/detail/CVE-2026-57114"], "fixes": ["4.6.59"], "products": [{"name": "praisonai", "path": "vulns/pypi/praisonai", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-57113", "noindex": false, "published": "2026-10-23T12:04:04.048Z", "modified": "2026-10-23T14:59:39.455Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "severity": "high", "epss": 0.00405, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-57113", "title": "PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion", "description": "PraisonAI is a multi-agent teams system. From version 2.6.0 to before version 4.6.59, PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/template@v1.0.0. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into ~/.praison/cache/templates/github/<owner>/<repo>/<template>/<ref> without normalizing each segment or checking that the final path remains inside the template cache root. A crafted ref such as ../../../../../../outside-delete-target therefore escapes the cache directory. The first load can write .cache_meta.json outside the c", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-f44v-7qgw-9gh9", "https://nvd.nist.gov/vuln/detail/CVE-2026-57113"], "fixes": ["4.6.59"], "products": [{"name": "praisonai", "path": "vulns/pypi/praisonai", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-56840", "noindex": false, "published": "2026-10-23T11:58:24.568Z", "modified": "2026-10-23T11:58:24.568Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00246, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-56840", "title": "PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools", "description": "PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the approval dashboard HTML. An attacker-controlled tool argument can inject JavaScript into that page. When a human opens the approval URL to inspect the risky tool request, the script runs in the dashboard origin and can POST to the same request's /approve/{request_id}/decide endpoint, causing HTTPApproval to return approved=True. This issue has been patched in version 4.6.59.", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-63v4-w882-g4x2", "https://nvd.nist.gov/vuln/detail/CVE-2026-56840"], "fixes": ["4.6.59"], "products": [{"name": "praisonai", "path": "vulns/pypi/praisonai", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-56838", "noindex": false, "published": "2026-10-23T11:58:01.475Z", "modified": "2026-10-23T11:58:01.475Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00146, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-56838", "title": "PraisonAI recipe.run_stream skips dangerous-tool policy enforcement", "description": "PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.59, PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explicitly passes allow_dangerous_tools=True. The normal recipe.run() path enforces this with _check_tool_policy(). The streaming path, recipe.run_stream(), loads the same recipe, checks dependencies, and then calls _execute_recipe() without running the dangerous-tool policy check. As a result, a recipe that honestly declares execute_command in TEMPLATE.yaml requires.tools is denied by recipe.run(), but reaches the execution engine through recipe.run_stream() with allow_dange", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-v847-hxxw-3pxg", "https://nvd.nist.gov/vuln/detail/CVE-2026-56838"], "fixes": ["4.6.59"], "products": [{"name": "praisonai", "path": "vulns/pypi/praisonai", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-56837", "noindex": false, "published": "2026-10-23T11:57:48.068Z", "modified": "2026-10-23T21:05:27.023Z", "cvss": 8.6, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "severity": "high", "epss": 0.00188, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-56837", "title": "PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing", "description": "PraisonAI is a multi-agent teams system. From version 4.6.56 to before version 4.6.59, PraisonAI's LinearBot starts a public webhook listener on 0.0.0.0 and treats LINEAR_WEBHOOK_SECRET as optional. When the secret is absent, startup only logs a warning and _handle_webhook() skips Linear-Signature verification entirely. An unauthenticated network caller who can reach the webhook endpoint can submit a forged Linear-Event: AgentSession request. The forged request is parsed, scheduled for background processing, dispatched to _handle_agent_session(), and passed into BotSessionManager.chat(). The bot then attempts to post the agent response back t", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-fc26-m9pf-v56q", "https://nvd.nist.gov/vuln/detail/CVE-2026-56837"], "fixes": ["4.6.59"], "products": [{"name": "praisonai", "path": "vulns/pypi/praisonai", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-56836", "noindex": false, "published": "2026-10-23T11:57:28.192Z", "modified": "2026-10-23T11:57:28.192Z", "cvss": 8.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "severity": "high", "epss": 0.00227, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-56836", "title": "PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard", "description": "PraisonAI is a multi-agent teams system. From version 4.5.112 to before version 4.6.59, PraisonAI's installed console entrypoint is Typer-first. In current releases, the recipe command is registered in the Typer app and praisonai recipe serve dispatches to the deprecated Typer command in src/praisonai/praisonai/cli/commands/recipe.py. That Typer command can start the Recipe HTTP server on a non-localhost interface with no authentication. It prints a deprecation warning, and then launches the server. Because config.auth is absent, create_app() does not attach the API-key or JWT middleware. Unauthenticated requests can then reach the recipe API", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-5qw8-f2g9-ff29", "https://nvd.nist.gov/vuln/detail/CVE-2026-56836"], "fixes": ["4.6.59"], "products": [{"name": "praisonai", "path": "vulns/pypi/praisonai", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-56835", "noindex": false, "published": "2026-10-23T11:57:11.852Z", "modified": "2026-10-23T11:57:11.852Z", "cvss": 8.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "severity": "high", "epss": 0.00215, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-56835", "title": "PraisonAI Slack app_mention bypasses configured user/channel authorization", "description": "PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowed_users, allowed_channels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack app_mention event handler. A Slack workspace user who can mention the bot in a channel where the Slack app is present can trigger the configured PraisonAI agent even when: the sender is not in BotConfig.allowed_users; the channel is not in BotConfig.allowed_channels; unknown_user_policy=\"deny\" is configured; and the same event content is correctly dropped by the normal message ", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qvpf-j64c-jmhr", "https://nvd.nist.gov/vuln/detail/CVE-2026-56835"], "fixes": ["4.6.59"], "products": [{"name": "praisonai", "path": "vulns/pypi/praisonai", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-56834", "noindex": false, "published": "2026-10-23T11:56:40.277Z", "modified": "2026-10-23T11:56:40.277Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.00373, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-56834", "title": "PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage", "description": "PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context Discovery feature exposes artifact helper tools through ctx.get_tools(). The implemented artifact tools do not enforce that the supplied artifact_path is an artifact created by the configured store or that it lives under the configured artifact base directory. Instead, artifact_head, artifact_tail, artifact_grep, and artifact_chunk wrap the caller-supplied path directly into an ArtifactRef and then read it from the host filesystem. As a result, any prompt/user/tool-caller that can influence those tool arguments can read files read", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-j7qx-p75m-wp7g", "https://nvd.nist.gov/vuln/detail/CVE-2026-56834"], "fixes": ["4.6.59"], "products": [{"name": "praisonai", "path": "vulns/pypi/praisonai", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-56833", "noindex": false, "published": "2026-10-23T11:56:09.502Z", "modified": "2026-10-23T21:05:34.632Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.0046, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-56833", "title": "PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal", "description": "PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The module also exports agent-callable tool factories. Those tools accept run_id and agent_id arguments from the tool caller. The underlying stores join those values into filesystem paths without rejecting absolute paths or .. traversal. Because run_id can be an absolute path and agent_id can contain traversal, a lower-trust prompt/user that can call these tools can read .jsonl and .log files outside the configured Dynamic Context base directory. This issue has be", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-22cj-m4wf-fv2c", "https://nvd.nist.gov/vuln/detail/CVE-2026-56833"], "fixes": ["4.6.59"], "products": [{"name": "praisonai", "path": "vulns/pypi/praisonai", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-56832", "noindex": false, "published": "2026-10-23T11:55:53.084Z", "modified": "2026-10-23T11:55:53.084Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00148, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-56832", "title": "PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals", "description": "PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordApproval approves a pending dangerous tool call when it sees any later non-bot message in the configured Discord channel whose text is classified as approval, such as yes. As a result, any user who can post in the configured approval channel can approve a pending high-risk tool call by sending yes after the approval message appears. the same PoV also shows that the Slack and Telegram messaging approval backends have no explicit approver allowlist parameter, but the primary report-grade issue is the Discord backend's unthreaded channel c", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8579-rgg5-ph2m", "https://nvd.nist.gov/vuln/detail/CVE-2026-56832"], "fixes": ["4.6.59"], "products": [{"name": "praisonai", "path": "vulns/pypi/praisonai", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-57112", "noindex": false, "published": "2026-09-15T10:13:21.700Z", "modified": "2026-09-16T17:51:54.611Z", "cvss": 8.3, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "severity": "high", "epss": 0.00224, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-57112", "title": "PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools", "description": "PraisonAI is a multi-agent teams system. From praisonaiagents 0.6.0 until 1.6.59 and PraisonAI 3.10.0 until 4.6.59, ToolsMCPServer.run_sse() in src/praisonai-agents/praisonaiagents/mcp/mcp_server.py mounts SseServerTransport on the legacy /sse and /messages/ endpoints without default Host, Origin, or authentication enforcement. A malicious website can use DNS rebinding against a reachable local or internal SSE server, supply attacker-controlled Host and Origin headers, enumerate registered tools, and invoke them with the server user's privileges. The Streamable HTTP transport rejects the same hostile Origin, which isolates the flaw to the leg", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vmf9-xx9w-86wx", "https://github.com/MervinPraison/PraisonAI/commit/2adfe7e8323f6deec66925cf15a885b6238895e9", "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.59"], "fixes": ["4.6.59"], "products": [{"name": "praisonai", "path": "vulns/pypi/praisonai", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-57145", "noindex": false, "published": "2026-09-14T15:10:45.705Z", "modified": "2026-09-14T18:11:30.131Z", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "critical", "epss": 0.00544, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-57145", "title": "PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation", "description": "PraisonAI is a multi-agent teams system. Prior to 4.6.62, src/praisonai/praisonai/tools/multiedit.py passes the LLM-controlled filepath parameter directly to open for reading and writing without traversal rejection, symlink resolution, a workspace boundary, or protected-path checks. Prompt-influenced agents can read files through edit and diff behavior or overwrite files accessible to the process, exposing secrets and enabling persistence or application tampering. This issue is fixed in 4.6.62.", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-29w3-p9w9-wc47", "https://github.com/MervinPraison/PraisonAI/commit/2a855c470077c7d2e2479a575f7ef7f548d51c33", "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.62"], "fixes": ["4.6.61"], "products": [{"name": "praisonai", "path": "vulns/pypi/praisonai", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-57132", "noindex": false, "published": "2026-09-14T15:09:19.782Z", "modified": "2026-09-16T15:09:30.644Z", "cvss": 8.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "severity": "high", "epss": 0.0051, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-57132", "title": "PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication", "description": "PraisonAI is a multi-agent teams system. Prior to 4.6.62, setting PRAISONAI_CALL_AUTH to disabled makes verify_token accept requests to /api/v1/agents/{id}/invoke without CALL_SERVER_TOKEN authentication. Deployments that use the application's advertised opt-out can expose registered agents and their connected tools or private context to unauthenticated invocation. The vulnerability is fixed in 4.6.62.", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8ccj-p46r-jwqq", "https://github.com/MervinPraison/PraisonAI/commit/2a855c470077c7d2e2479a575f7ef7f548d51c33", "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.62"], "fixes": ["4.6.61"], "products": [{"name": "praisonai", "path": "vulns/pypi/praisonai", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-57131", "noindex": false, "published": "2026-09-14T15:06:20.246Z", "modified": "2026-09-14T16:28:08.459Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.00972, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-57131", "title": "praisonai: Jobs API exposes agent-execution endpoints with no authentication", "description": "PraisonAI is a multi-agent teams system. Prior to 4.6.58, praisonai.jobs.server.create_app mounts praisonai.jobs.router.create_router under /api/v1/runs without authentication or per-job authorization. Network clients can submit attacker-controlled prompts and agent configuration, list and read jobs, stream results, and cancel or delete other jobs, exposing service credentials and connected tool capabilities to unauthorized agent execution. This vulnerability is fixed in 4.6.58.", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-fq2m-6wqh-x44g", "https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1", "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58"], "fixes": ["4.6.59"], "products": [{"name": "praisonai", "path": "vulns/pypi/praisonai", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-57124", "noindex": false, "published": "2026-09-14T15:04:54.198Z", "modified": "2026-09-14T19:02:35.012Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.01035, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-57124", "title": "PraisonAI UI MCP connect endpoint allows unauthenticated local command execution", "description": "PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands bind to 0.0.0.0 by default, a reachable unauthenticated client can execute commands as the UI service account even when the MCP handshake later fails. This vulnerability is fixed in 4.6.59.", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-p75f-6fp4-p57w", "https://github.com/MervinPraison/PraisonAI/commit/2adfe7e8323f6deec66925cf15a885b6238895e9", "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.59"], "fixes": ["4.6.59"], "products": [{"name": "praisonai", "path": "vulns/pypi/praisonai", "ecosystem": "PyPI"}]}], "total": 104, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 6, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "praisonai", "path": "vulns/pypi/praisonai", "ecosystem": "PyPI"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": ["4.6.77", "4.6.75", "4.6.74", "4.6.72", "4.6.71", "4.6.70", "4.6.68", "4.6.67", "4.6.65", "4.6.64", "4.6.63", "4.6.62"], "stats": {"recent": 15, "kev": 0}, "lastmod": "2026-10-23T21:05:34.632Z", "early_advisories": [], "license": "Puedes utilizar libremente la selección de PatchFirst y nuestras aportaciones (prioridades, alertas tempranas, textos, resúmenes y agregados) para tus propios fines, incluido el uso interno de tu empresa. La reventa, la distribución comercial y la creación masiva de réplicas de esta selección o de estas aportaciones requieren un acuerdo escrito con el operador. Siempre que uses o publiques la selección o nuestras aportaciones, cita a PatchFirst (https://patchfirst.dev/vulns/) con este enlace a la página del flujo de tu región. Los registros originales de fuentes abiertas siguen sujetos a sus respectivas licencias y condiciones. Estas condiciones no limitan tus derechos sobre los datos originales, que puedes obtener directamente de esas fuentes.", "terms_url": "https://patchfirst.dev/es/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst selecciona, normaliza y combina los registros; se pueden añadir resúmenes y traducciones. Las noticias incluyen un enlace a la fuente original en cada entrada.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Las licencias de las bases originales varían; consulta el catálogo de fuentes."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Puntuaciones públicas gratuitas; se solicita atribución (FIRST EPSS, puntuaciones generadas por Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}