{"kind": "product", "path": "vulns/pypi/praisonaiagents", "name": "praisonaiagents", "product": "praisonaiagents", "ecosystem": "PyPI", "items": [{"id": "CVE-2026-57118", "noindex": false, "published": "2026-10-12T18:48:22.664Z", "modified": "2026-10-15T13:38:59.225Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.00413, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-57118", "title": "PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints", "description": "PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register GET /{path}/list, POST /{path}, and `POST /{path}/{agent_id}' without access-control checks before listing agents or calling agent.chat. A remotely exposed server can therefore let unauthenticated clients enumerate agents, consume model resources, access connected private context, and trigger agent tools or workflow side effects. This vulnerability is fixed in praisonaiagents 1.6.59.", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-x8cv-xmq7-p8xp", "https://github.com/MervinPraison/PraisonAI/commit/b4270173d4123fb1ee8910588f0896668ee21b59", "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.59"], "fixes": ["1.6.59"], "products": [{"name": "praisonaiagents", "path": "vulns/pypi/praisonaiagents", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-57143", "noindex": false, "published": "2026-10-12T18:48:00.429Z", "modified": "2026-10-13T15:50:26.330Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L", "severity": "high", "epss": 0.00275, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-57143", "title": "PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter", "description": "PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_web SearxNG provider pass the LLM-controlled searxng_url parameter directly to requests.get without validating its scheme, host, port, or resolved address. Prompt-injected content can direct the default search tool to internal JSON services, distinguish open and closed internal ports, and attempt cloud-metadata requests, with returned JSON results entering agent context. This issue is fixed in praisonaiagents 1.6.62.", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4pcv-mg8v-vrgf", "https://github.com/MervinPraison/PraisonAI/commit/2a855c470077c7d2e2479a575f7ef7f548d51c33", "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.62"], "fixes": ["1.6.61"], "products": [{"name": "praisonaiagents", "path": "vulns/pypi/praisonaiagents", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-57112", "noindex": false, "published": "2026-09-15T10:13:21.700Z", "modified": "2026-09-16T17:51:54.611Z", "cvss": 8.3, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "severity": "high", "epss": 0.00224, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-57112", "title": "PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools", "description": "PraisonAI is a multi-agent teams system. From praisonaiagents 0.6.0 until 1.6.59 and PraisonAI 3.10.0 until 4.6.59, ToolsMCPServer.run_sse() in src/praisonai-agents/praisonaiagents/mcp/mcp_server.py mounts SseServerTransport on the legacy /sse and /messages/ endpoints without default Host, Origin, or authentication enforcement. A malicious website can use DNS rebinding against a reachable local or internal SSE server, supply attacker-controlled Host and Origin headers, enumerate registered tools, and invoke them with the server user's privileges. The Streamable HTTP transport rejects the same hostile Origin, which isolates the flaw to the leg", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vmf9-xx9w-86wx", "https://github.com/MervinPraison/PraisonAI/commit/2adfe7e8323f6deec66925cf15a885b6238895e9", "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.59"], "fixes": ["1.6.59"], "products": [{"name": "praisonaiagents", "path": "vulns/pypi/praisonaiagents", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-57129", "noindex": false, "published": "2026-09-14T14:54:47.832Z", "modified": "2026-09-14T15:19:46.234Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.0053, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-57129", "title": "PraisonAI: Arbitrary File Read via `@file:` Mention Path Traversal", "description": "PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, MentionsParser._process_file_mention accepts file-mention values and falls back from workspace-relative resolution to Path(file_path) without traversal, symlink, or workspace-boundary validation. Prompt input from users, bots, or workflows can therefore read arbitrary files accessible to the process, including credentials, keys, environment files, source code, and system configuration. This issue is fixed in praisonaiagents 1.6.59.", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-2rcg-mm5h-xchx", "https://github.com/MervinPraison/PraisonAI/commit/b4270173d4123fb1ee8910588f0896668ee21b59", "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.59"], "fixes": ["1.6.59"], "products": [{"name": "praisonaiagents", "path": "vulns/pypi/praisonaiagents", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-57126", "noindex": false, "published": "2026-09-14T14:49:25.007Z", "modified": "2026-09-14T19:15:17.276Z", "cvss": 8.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N", "severity": "high", "epss": 0.00379, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-57126", "title": "praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS", "description": "PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, SpiderTools._validate_url calls _host_is_blocked, which checks literal host encodings but does not resolve DNS names before scrape_page, crawl, extract_links, extract_text, or URL-mention fetches connect. An attacker-controlled hostname resolving to a loopback, private, link-local, or cloud-metadata address therefore bypasses the SSRF policy without a rebinding race and can expose internal responses to the agent. This issue is fixed in praisonaiagents 1.6.58.", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vxgj-xg5c-p4h7", "https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1", "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58"], "fixes": ["1.6.59"], "products": [{"name": "praisonaiagents", "path": "vulns/pypi/praisonaiagents", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-57120", "noindex": false, "published": "2026-09-14T14:48:14.932Z", "modified": "2026-09-16T15:07:09.714Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00555, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-57120", "title": "PraisonAI: execute_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunder", "description": "PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, execute_code sandbox mode permits runtime assembly of blocklisted dunder names and allows str.format or str.format_map to resolve dotted fields through C-level attribute access that bypasses _safe_getattr. This exposes class, qualified-name, base-class, globals, and object-dictionary attributes to prompt-influenced code when approval is automatically granted, producing a high-impact read primitive without establishing a complete in-process execution chain. This issue is fixed in praisonaiagents 1.6.59.", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-pv2j-rghr-v5r9", "https://github.com/MervinPraison/PraisonAI/commit/2adfe7e8323f6deec66925cf15a885b6238895e9", "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.59"], "fixes": ["1.6.59"], "products": [{"name": "praisonaiagents", "path": "vulns/pypi/praisonaiagents", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-57123", "noindex": false, "published": "2026-09-14T14:46:12.791Z", "modified": "2026-09-14T18:11:47.930Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.00904, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-57123", "title": "PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in", "description": "PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, ToolsMCPServer.run_sse and launch_tools_mcp_server bind to 0.0.0.0 and create /sse and /messages/ routes without invoking the available SecurityConfig authentication, origin-validation, or DNS-rebinding controls. Any reachable client can list and invoke registered tools, and a browser can target a local instance through DNS rebinding, with impact determined by the registered file, shell, and code-execution tools. This vulnerability is fixed in praisonaiagents 1.6.59.", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-x227-pf99-vffg", "https://github.com/MervinPraison/PraisonAI/commit/2adfe7e8323f6deec66925cf15a885b6238895e9", "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.59"], "fixes": ["1.6.59"], "products": [{"name": "praisonaiagents", "path": "vulns/pypi/praisonaiagents", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-57130", "noindex": false, "published": "2026-09-14T14:28:09.634Z", "modified": "2026-09-14T14:47:00.197Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00462, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-57130", "title": "PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters", "description": "PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai-agents/praisonaiagents/tools/email_tools.py interpolates LLM-controlled from_addr, subject, and query values directly into quoted IMAP SEARCH criteria. Embedded quote, backslash, newline, or null characters can escape the intended criterion and alter IMAP operations when search_emails, reply_email, or archive_email is exposed to an agent with configured email credentials, allowing mailbox data access, modification, deletion, or connection disruption. This issue is fixed in praisonaiagents 1.6.59.", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-c969-5x3p-vq3v", "https://github.com/MervinPraison/PraisonAI/commit/b4270173d4123fb1ee8910588f0896668ee21b59", "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.59"], "fixes": ["1.6.59"], "products": [{"name": "praisonaiagents", "path": "vulns/pypi/praisonaiagents", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-57128", "noindex": false, "published": "2026-09-14T14:25:42.764Z", "modified": "2026-09-14T15:28:17.612Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.00253, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-57128", "title": "PraisonAI: Unauthenticated Event Injection via SSE `/publish` Endpoint", "description": "PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the SSE server in src/praisonai-agents/praisonaiagents/server/server.py does not consult ServerConfig.auth_token before handling /publish, /events, or /info requests. A network client that can reach the server can broadcast arbitrary events to connected clients and obtain server configuration and client-count information. This issue is fixed in praisonaiagents 1.6.58.", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-35w5-pcw4-jx94", "https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1", "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58"], "fixes": ["1.6.59"], "products": [{"name": "praisonaiagents", "path": "vulns/pypi/praisonaiagents", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-57115", "noindex": false, "published": "2026-09-14T14:22:50.181Z", "modified": "2026-09-14T18:11:56.728Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.0043, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-57115", "title": "PraisonAI: SpiderTools redirect-target SSRF protection bypass", "description": "PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, SpiderTools.scrape_page validates only the initial URL and lets requests.Session.get follow redirects automatically, so a public-looking URL can redirect to a loopback, private, link-local, or metadata address without revalidation. The redirected response body is returned through scrape_page and its extract_links, crawl, and extract_text callers, allowing disclosure from otherwise blocked services. This issue is fixed in praisonaiagents 1.6.59.", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6h9p-93hq-q7h6", "https://github.com/MervinPraison/PraisonAI/commit/b4270173d4123fb1ee8910588f0896668ee21b59", "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.59"], "fixes": ["1.6.59"], "products": [{"name": "praisonaiagents", "path": "vulns/pypi/praisonaiagents", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-57125", "noindex": false, "published": "2026-09-14T14:19:42.671Z", "modified": "2026-09-14T19:18:16.766Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.00601, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-57125", "title": "PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass", "description": "PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.59 and praisonaiagents 1.6.59, the unauthenticated POST /api/v1/runs Jobs API accepts attacker-controlled agent_yaml, and the approve field can mark execute_command as YAML-approved before @require_approval checks critical tools. This chain allows a remote caller to cause a configured language model agent to invoke arbitrary operating-system commands without credentials or operator interaction. This vulnerability is fixed in praisonai 4.6.59 and praisonaiagents 1.6.59 as fixed versions.", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4869-x4pr-q22x", "https://github.com/MervinPraison/PraisonAI/commit/2adfe7e8323f6deec66925cf15a885b6238895e9", "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.59"], "fixes": ["1.6.59"], "products": [{"name": "praisonaiagents", "path": "vulns/pypi/praisonaiagents", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-55527", "noindex": false, "published": "2026-08-25T15:09:07.500Z", "modified": "2026-08-25T19:21:08.622Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "severity": "high", "epss": 0.00484, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-55527", "title": "PraisonAI: Arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location", "description": "PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the FileMemory constructor joins unsanitized user_id into self.user_path. A caller supplying ../ or path separators can escape the memory directory and write JSON data to arbitrary process-writable locations. The fix sanitizes user_id before constructing self.user_path. This issue is fixed in version 1.6.58.", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-gxmw-5f7x-6g22", "https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1", "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58"], "fixes": ["1.6.58"], "products": [{"name": "praisonaiagents", "path": "vulns/pypi/praisonaiagents", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-55530", "noindex": false, "published": "2026-08-25T14:45:07.570Z", "modified": "2026-08-25T16:26:22.899Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L", "severity": "medium", "epss": 0.00166, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-55530", "title": "PraisonAI: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool", "description": "PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, ast_grep_rewrite lacks the @require_approval decorator used by sibling mutation tools. With dry_run=False, an agent-controlled call can pass --update-all and a broad path to rewrite matching files without the expected authorization gate. This issue is fixed in version 1.6.58.", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-cfxv-8fw8-rwpv", "https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1", "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58"], "fixes": ["1.6.58"], "products": [{"name": "praisonaiagents", "path": "vulns/pypi/praisonaiagents", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-55526", "noindex": false, "published": "2026-08-25T14:36:09.934Z", "modified": "2026-08-25T19:21:26.954Z", "cvss": 8.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N", "severity": "high", "epss": 0.00357, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-55526", "title": "PraisonAI: SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)", "description": "PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, spider_tools._host_is_blocked() does not resolve ordinary hostnames before scrape_page fetches them. A hostname such as 127.0.0.1.nip.io passes validation and resolves to loopback, permitting internal HTTP access. The fix uses socket.getaddrinfo and fails closed on DNS errors. This issue is fixed in version 1.6.58.", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-x44h-65qv-cw74", "https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1", "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58"], "fixes": ["1.6.58"], "products": [{"name": "praisonaiagents", "path": "vulns/pypi/praisonaiagents", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-55528", "noindex": false, "published": "2026-08-25T14:32:05.929Z", "modified": "2026-08-25T18:17:51.763Z", "cvss": 8.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "severity": "high", "epss": 0.00486, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-55528", "title": "praisonaiagents: AgentServer declares auth_token but never enforces it on any route (CWE-862)", "description": "PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, AgentServer exposes ServerConfig.auth_token but AgentServer._create_app does not check it on any route. A remote caller can subscribe, publish, and perform other actions without a valid bearer token or X-Auth-Token even when authentication is configured. This issue is fixed in version 1.6.58.", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-7g3p-92qq-8wvh", "https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1", "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58"], "fixes": ["1.6.58"], "products": [{"name": "praisonaiagents", "path": "vulns/pypi/praisonaiagents", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-55525", "noindex": false, "published": "2026-08-25T14:07:08.551Z", "modified": "2026-08-25T16:14:41.881Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.00507, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-55525", "title": "PraisonAI: SSRF via redirect-following in praisonaiagents web_crawl", "description": "PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the web_crawl function validates only the initial URL before _crawl_with_httpx uses httpx.Client(follow_redirects=True). Redirect targets are not revalidated, so an attacker who influences a crawl target can redirect a public URL to loopback, private network, or cloud metadata services while ALLOW_LOCAL_CRAWL remains disabled. The fetched internal response is returned to the agent context. This issue is fixed in version 1.6.58.", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-5r34-2g38-6569", "https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1", "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58"], "fixes": ["1.6.58"], "products": [{"name": "praisonaiagents", "path": "vulns/pypi/praisonaiagents", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-55524", "noindex": false, "published": "2026-08-05T19:58:46.038Z", "modified": "2026-08-06T14:43:50.259Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N", "severity": "high", "epss": 0.00242, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-55524", "title": "PraisonAI: SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap)", "description": "PraisonAI is a multi-agent teams system. In versions prior to 1.6.58, the web_crawl tool performs its SSRF check only on the initially supplied URL, allowing the protection to be bypassed so the tool connects to attacker-chosen internal destinations. The check resolves the hostname once with socket.gethostbyname and rejects private/loopback/link-local results, but then passes the URL to a fetcher using httpx.Client(follow_redirects=True) (or urllib.request.urlopen when httpx is absent, which also follows redirects) that re-resolves the hostname at connect time with no further validation. This validate-here/fetch-there gap is exploitable throu", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vg6p-v9vm-6fgj", "https://nvd.nist.gov/vuln/detail/CVE-2026-55524"], "fixes": ["1.6.58"], "products": [{"name": "praisonaiagents", "path": "vulns/pypi/praisonaiagents", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-55523", "noindex": false, "published": "2026-08-05T19:26:22.324Z", "modified": "2026-08-06T14:38:08.242Z", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N", "severity": "high", "epss": 0.00468, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-55523", "title": "PraisonAI has a`web_crawl` SSRF protection bypass via unchecked redirect targets", "description": "PraisonAI is a multi-agent teams system. In versions 1.5.128 through 1.6.57, the praisonaiagents.tools.web_crawl_tools.web_crawl() function is vulnerable to server-side request forgery. While it validates the initially supplied URL and blocks direct loopback and private destinations, its default httpx fallback uses httpx.Client(follow_redirects=True) and does not revalidate intermediate or final redirect targets. An attacker who can influence a URL passed to web_crawl(), directly or through an agent or tool workflow, can supply an attacker-controlled public URL that passes the initial host check and then redirects to loopback, private-network", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8hjw-25cg-g52h", "https://nvd.nist.gov/vuln/detail/CVE-2026-55523"], "fixes": ["1.6.58"], "products": [{"name": "praisonaiagents", "path": "vulns/pypi/praisonaiagents", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-55522", "noindex": false, "published": "2026-08-05T19:01:43.051Z", "modified": "2026-08-06T18:45:05.648Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00224, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-55522", "title": "PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code", "description": "PraisonAI is a multi-agent teams system. In versions 3.9.26 through 4.6.57 of praiseonai and 0.12.12 through 1.6.57 of praiseonaiagents, the workflow \"include\" feature is vulnerable to code execution. Workflow._execute_include() implicitly imports and runs an included recipe's tools.py via a raw importlib.util.spec_from_file_location() and spec.loader.exec_module() call, without honoring the PRAISONAI_ALLOW_TEMPLATE_TOOLS/PRAISONAI_ALLOW_LOCAL_TOOLS autoload opt-in gates or routing through the centralized safe loader that protects the other tools.py autoload paths. As a result, a workflow that includes an attacker-controlled local recipe dire", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-hxmv-c4g6-5fqc", "https://nvd.nist.gov/vuln/detail/CVE-2026-55522"], "fixes": ["1.6.58"], "products": [{"name": "praisonaiagents", "path": "vulns/pypi/praisonaiagents", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-47395", "noindex": false, "published": "2026-07-21T15:52:52.682Z", "modified": "2026-07-21T17:15:13.196Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00183, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-47395", "title": "PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context", "description": "PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, PraisonAI's direct-prompt CLI automatically expands `@url:` mentions in raw prompt text before agent execution begins. If a prompt contains `@url:<http-or-https-url>`, the CLI calls `MentionsParser.process(...)`. The `@url:` handler then performs a direct `urllib.request.urlopen()` request to the attacker-controlled URL and returns the response body. That response body is prepended to the final model prompt context. There is no loopback/private-address restriction, no metadata-service restriction, and no approval ", "references": ["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-5cxw-77wg-jrf3", "https://github.com/MervinPraison/PraisonAI/pull/1684", "https://github.com/MervinPraison/PraisonAI/commit/b0d8f777528f3253a0cfb0a3ef65455da6ae32f6"], "fixes": ["1.6.40"], "products": [{"name": "praisonaiagents", "path": "vulns/pypi/praisonaiagents", "ecosystem": "PyPI"}]}], "total": 50, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 3, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "praisonaiagents", "path": "vulns/pypi/praisonaiagents", "ecosystem": "PyPI"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": ["1.7.19", "1.7.18", "1.7.17", "1.7.16", "1.7.15", "1.7.14", "1.7.13", "1.7.12", "1.7.11", "1.7.10", "1.7.9", "1.7.8"], "stats": {"recent": 2, "kev": 0}, "lastmod": "2026-10-15T13:38:59.225Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}