PraisonAI
AI Agents Framework with Self Reflection and MCP support
2.3.42version the registry lists (1 published)
106reported issues
Yeslisted version affected
Hold off. At least one reported issue affects the version the registry lists. The package may have a newer release, so read the issue below and check before you install.
Registry name io.github.MervinPraison/praisonai
· Source code
Reported issues
Each issue is counted once, with its other IDs listed under it. "Listed version" means the version the registry lists: "Not flagged" means OSV doesn't mark it as affected, and "Not checked" means the source gives no version we can compare.
| Issue | Severity | Listed version | Reported |
|---|---|---|---|
| GHSA-26mh-57q7-jfvrPraisonAI vulnerable to Remote Code Execution via Broken AST SandboxAlso filed as CVE-2026-61438 | high | Affected | Oct 29, 2026 |
| GHSA-cv3g-hj65-pcfhPraisonAI: Shell command allowlist bypass via find -exec built-in actionAlso filed as CVE-2026-61434, PYSEC-2026-4254 | high | Affected | Oct 8, 2026 |
| GHSA-9mp3-24cc-77mgPraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool CallsAlso filed as CVE-2026-61445, PYSEC-2026-4253 | critical | Affected | Oct 8, 2026 |
| GHSA-5r6c-gj4g-r697PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backendAlso filed as CVE-2026-60085, PYSEC-2026-4250 | high | Affected | Oct 8, 2026 |
| GHSA-4w49-gwv8-fpjgPraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRFAlso filed as CVE-2026-60091, PYSEC-2026-4249 | high | Affected | Oct 8, 2026 |
| GHSA-4r3p-w3mc-5v34PraisonAI: Prompt-injection defense blocks only when 3+ detector families fire simultaneously; realistic single-vector injections pass through unblockedAlso filed as CVE-2026-60086, PYSEC-2026-4248 | medium | Affected | Oct 8, 2026 |
| GHSA-79fv-7hq9-w7xgPraisonAI: API deploy code generator embeds unescaped YAML fields into Python sourceAlso filed as CVE-2026-61433, PYSEC-2026-4251 | high | Affected | Oct 8, 2026 |
| GHSA-2gpf-2492-q9jhPraisonAI: Call API localhost-only authentication bypass via spoofed Host headerAlso filed as CVE-2026-61435, PYSEC-2026-4247 | high | Affected | Oct 8, 2026 |
| GHSA-q7m5-3jmv-vm48PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspaceAlso filed as CVE-2026-61431, PYSEC-2026-4258 | medium | Affected | Oct 8, 2026 |
| GHSA-xpx6-x8c2-mw5wPraisonAI: Project custom command templates can read outside-workspace files into model promptsAlso filed as CVE-2026-60088, PYSEC-2026-4261 | medium | Affected | Oct 8, 2026 |
| GHSA-wf65-4jjx-q444PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDLAlso filed as CVE-2026-60090, PYSEC-2026-4260 | medium | Affected | Oct 8, 2026 |
| GHSA-fj8f-m44g-c479PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level ThreatsAlso filed as CVE-2026-61439, PYSEC-2026-4255 | high | Affected | Oct 7, 2026 |
| GHSA-g6j7-pffp-8whgPraisonAI: Code Injection via f-string Interpolation in Deploy API Server GenerationAlso filed as CVE-2026-61444, CVE-2026-62176, PYSEC-2026-4256 | critical | Affected | Oct 7, 2026 |
| GHSA-7c92-x8vg-4258PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agentsAlso filed as CVE-2026-61436, PYSEC-2026-4252 | high | Affected | Oct 7, 2026 |
| GHSA-qj9c-59p6-8cgxPraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofingAlso filed as CVE-2026-61428, PYSEC-2026-4259 | high | Affected | Oct 7, 2026 |
| GHSA-6g6r-q6gw-w8fgPraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)Also filed as CVE-2026-55536, PYSEC-2026-3886 | critical | Affected | Aug 25, 2026 |
| GHSA-pvph-5j39-v8qcPraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP serverAlso filed as CVE-2026-55532, PYSEC-2026-3892 | high | Affected | Aug 25, 2026 |
| GHSA-gfq8-hmph-9gjvPraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secretAlso filed as CVE-2026-55533, PYSEC-2026-3889 | high | Affected | Aug 25, 2026 |
| GHSA-2jgc-f764-c5r2PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and deleteAlso filed as CVE-2026-55539, PYSEC-2026-3885 | high | Affected | Aug 25, 2026 |
| GHSA-pvxx-r596-f5qjPraisonAI: `--api-key` flag on `praisonai serve` is not properly enforcedAlso filed as CVE-2026-55541, PYSEC-2026-3893 | high | Affected | Aug 25, 2026 |
| GHSA-hmfx-4v44-9qw9PraisonAI vulnerable to Server-Side Request Forgery via DNS rebinding bypass in webhook_url validationAlso filed as CVE-2026-55535, PYSEC-2026-3890 | medium | Affected | Aug 25, 2026 |
| GHSA-rg5q-pp8p-f7jmPraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114Also filed as CVE-2026-55537, PYSEC-2026-3895 | high | Affected | Aug 25, 2026 |
| GHSA-r7v3-x45f-g7hpPraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticatedAlso filed as CVE-2026-55538, PYSEC-2026-3894 | high | Affected | Aug 25, 2026 |
| GHSA-ch89-h4r2-c8f8PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinksAlso filed as CVE-2026-55540, PYSEC-2026-3888 | high | Affected | Aug 25, 2026 |
| GHSA-wv94-5qcp-6m36PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced)Also filed as CVE-2026-55531, PYSEC-2026-3897 | medium | Affected | Aug 25, 2026 |
| GHSA-wj6g-v78p-6fx3PraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local MCP serverAlso filed as CVE-2026-55529, PYSEC-2026-3896 | medium | Affected | Aug 25, 2026 |
| GHSA-hc5v-gxvj-58whPraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surfaceAlso filed as CVE-2026-61427, PYSEC-2026-4257 | high | Affected | Jul 15, 2026 |
| GHSA-8ccj-p46r-jwqqPraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authenticationAlso filed as CVE-2026-57132, PYSEC-2026-3508 | high | Affected | Jun 18, 2026 |
| GHSA-29w3-p9w9-wc47PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path ValidationAlso filed as CVE-2026-57145, PYSEC-2026-3500 | critical | Affected | Jun 18, 2026 |
| GHSA-gcq3-mfvh-3x25PraisonAI Code agent tools fail open without a workspace boundaryAlso filed as CVE-2026-56839, PYSEC-2026-3512 | high | Affected | Jun 18, 2026 |
| GHSA-p75f-6fp4-p57wPraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonaiAlso filed as CVE-2026-57124, PYSEC-2026-3517 | critical | Affected | Jun 18, 2026 |
| GHSA-x92v-rpx6-p6cwPraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)Also filed as CVE-2026-57122, PYSEC-2026-3523 | high | Affected | Jun 18, 2026 |
| GHSA-fq2m-6wqh-x44gPraisonAI: Jobs API exposes agent-execution endpoints with no authenticationAlso filed as CVE-2026-57131, PYSEC-2026-3511 | critical | Affected | Jun 18, 2026 |
| GHSA-j4hj-7hfh-g2f4praisonai: recipe serve auth middleware silently disables itself when no secret is setAlso filed as CVE-2026-57127, PYSEC-2026-3513 | critical | Affected | Jun 18, 2026 |
| GHSA-4869-x4pr-q22xPraisonAI: Unauthenticated RCE via Jobs API + Approval BypassAlso filed as CVE-2026-57125, PYSEC-2026-3501, PYSEC-2026-3529 | critical | Affected | Jun 18, 2026 |
| GHSA-p4pj-vh7h-6cqhPraisonAI: Unauthenticated Local File Inclusion via agent_file path in PraisonAI Jobs APIAlso filed as CVE-2026-57119, PYSEC-2026-3516 | high | Affected | Jun 18, 2026 |
| GHSA-hvhp-v2gc-268qPraisonAI has an Arbitrary File Write in Python APIAlso filed as CVE-2026-47397, PYSEC-2026-2916 | high | Affected | May 29, 2026 |
| GHSA-vg22-4gmj-prxwPraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool executionAlso filed as CVE-2026-47391, PYSEC-2026-478 | critical | Affected | May 29, 2026 |
| GHSA-9cr9-25q5-8prjPraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validateAlso filed as CVE-2026-47394, PYSEC-2026-2908 | high | Affected | May 29, 2026 |
| GHSA-4mr5-g6f9-cfrhPraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)Also filed as CVE-2026-47392, PYSEC-2026-463, PYSEC-2026-483 | critical | Affected | May 29, 2026 |
| GHSA-5cxw-77wg-jrf3PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model contextAlso filed as CVE-2026-47395, PYSEC-2026-2903, PYSEC-2026-2942 | medium | Affected | May 29, 2026 |
| GHSA-8444-4fhq-fxpqPraisonAI `deploy --type api` emits a Flask server with authentication disabled by defaultAlso filed as CVE-2026-47393, PYSEC-2026-465 | critical | Affected | May 29, 2026 |
| GHSA-86qc-r5v2-v6x6PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unsetAlso filed as CVE-2026-47396, PYSEC-2026-466 | critical | Affected | May 29, 2026 |
| GHSA-5c6w-wwfq-7qqmPraisonAI spider_tools SSRF protection bypass via alternate loopback host encodingsAlso filed as CVE-2026-47390, PYSEC-2026-2902, PYSEC-2026-2941 | medium | Affected | May 29, 2026 |
| GHSA-78r8-wwqv-r299PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334Also filed as CVE-2026-47398, CVE-2026-64824, PYSEC-2026-2905 | high | Affected | May 29, 2026 |
| GHSA-9q28-ghcr-c4x3PraisonAI's symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`Also filed as CVE-2026-44340, PYSEC-2026-2909 | high | Affected | May 11, 2026 |
| GHSA-gmjg-hv98-qggqPraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables executeAlso filed as CVE-2026-44339, PYSEC-2026-2915, PYSEC-2026-2948 | high | Affected | May 11, 2026 |
| GHSA-9mqq-jqxf-grvwPraisonAI MCP `tools/call` path-traversal => RCE via Python `.pth` injectionAlso filed as CVE-2026-44336, PYSEC-2026-472 | critical | Affected | May 11, 2026 |
| GHSA-rg3h-x3jw-7jm5PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)Also filed as CVE-2026-41496, PYSEC-2026-2923, PYSEC-2026-2952 | high | Affected | Apr 17, 2026 |
| GHSA-9qhq-v63v-fv3jPraisonAI has an incomplete fix for CVE-2026-34935 - OS Command InjectionAlso filed as CVE-2026-41497, PYSEC-2026-473 | critical | Affected | Apr 17, 2026 |
| GHSA-8x8f-54wf-vv92PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessionsAlso filed as CVE-2026-40289, PYSEC-2026-467, PYSEC-2026-485 | critical | Affected | Apr 10, 2026 |
| GHSA-vc46-vw85-3wvmPraisonAI has critical RCE via `type: job` workflow YAMLAlso filed as CVE-2026-40288, PYSEC-2026-477, PYSEC-2026-488 | critical | Affected | Apr 10, 2026 |
| GHSA-g985-wjh9-qxxcPraisonAI Vulnerable to RCE via Automatic tools.py ImportAlso filed as CVE-2026-40287, PYSEC-2026-2914, PYSEC-2026-2947 | high | Affected | Apr 10, 2026 |
| GHSA-x783-xp3g-mqhpPraisonAI: SQLiteConversationStore didn't validate table_prefix when constructing SQL queriesAlso filed as CVE-2026-40315, PYSEC-2026-2925 | medium | Affected | Apr 10, 2026 |
| GHSA-8frj-8q3m-xhgmPraisonAI Vulnerable to Server-Side Request Forgery via Unvalidated webhook_url in Jobs APIAlso filed as CVE-2026-40114, PYSEC-2026-2906 | high | Affected | Apr 10, 2026 |
| GHSA-2g3w-cpc4-chr4PraisonAI Vulnerable to Implicit Execution of Arbitrary Code via Automatic `tools.py` LoadingAlso filed as CVE-2026-40156, PYSEC-2026-2895 | high | Affected | Apr 10, 2026 |
| GHSA-f2h6-7xfr-xm8wPraisonAI Vulnerable to Decompression Bomb DoS via Recipe Bundle Extraction Without Size LimitsAlso filed as CVE-2026-40148, PYSEC-2026-2912 | medium | Affected | Apr 10, 2026 |
| GHSA-pv9q-275h-rh7xPraisonAI Vulnerable Untrusted Remote Template Code ExecutionAlso filed as CVE-2026-40154, PYSEC-2026-476 | critical | Affected | Apr 10, 2026 |
| GHSA-qwgj-rrpj-75xmPraisonAI: Hardcoded `approval_mode="auto"` in Chainlit UI Overrides Administrator Configuration, Enabling Unapproved Shell Command ExecutionAlso filed as CVE-2026-56075 | high | Affected | Apr 10, 2026 |
| GHSA-3c4r-6p77-xwr7PraisonAI Vulnerable to Code Injection and Protection Mechanism FailureAlso filed as CVE-2026-40158, PYSEC-2026-2898 | high | Affected | Apr 10, 2026 |
| GHSA-pm96-6xpr-978xPraisonAI: Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOSAlso filed as CVE-2026-40151, PYSEC-2026-2919 | medium | Affected | Apr 10, 2026 |
| GHSA-4wr3-f4p3-5wjhPraisonAI: Unauthenticated Allow-List Manipulation Bypasses Agent Tool Approval Safety ControlsAlso filed as CVE-2026-40149, PYSEC-2026-2901 | high | Affected | Apr 10, 2026 |
| GHSA-2xgv-5cv2-47vvPraisonAI has Unrestricted Upload Size in WSGI Recipe Registry Server that Enables Memory Exhaustion DoSAlso filed as CVE-2026-40115, PYSEC-2026-2896 | medium | Affected | Apr 10, 2026 |
| GHSA-q5r4-47m9-5mc7PraisonAI: Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate LimitsAlso filed as CVE-2026-40116, PYSEC-2026-2920 | high | Affected | Apr 10, 2026 |
| GHSA-fvxx-ggmx-3cjgPraisonAI Vulnerable to Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-varsAlso filed as CVE-2026-40113, PYSEC-2026-2913 | high | Affected | Apr 10, 2026 |
| GHSA-cfg2-mxfj-j6pwPraisonAI Vulnerable to Stored XSS via Unsanitized Agent Output in HTML Rendering (nh3 Not a Required Dependency)Also filed as CVE-2026-40112, PYSEC-2026-2910 | medium | Affected | Apr 10, 2026 |
| GHSA-pj2r-f9mw-vrcqPraisonAI Vulnerable to Sensitive Environment Variable Exposure via Untrusted MCP Subprocess ExecutionAlso filed as CVE-2026-40159, PYSEC-2026-2918 | medium | Affected | Apr 10, 2026 |
| GHSA-2763-cj5r-c79mPraisonAI Vulnerable to OS Command InjectionAlso filed as CVE-2026-40088, PYSEC-2026-461 | critical | Affected | Apr 8, 2026 |
| GHSA-hwg5-x759-7wjgPraisonAI has Template Injection in Agent Tool DefinitionsAlso filed as CVE-2026-39891, PYSEC-2026-2917 | high | Affected | Apr 8, 2026 |
| GHSA-f292-66h9-fpmfPraisonAI Has Unauthenticated SSE Event Stream that Exposes All Agent Activity in A2U ServerAlso filed as CVE-2026-39889, PYSEC-2026-2911 | high | Affected | Apr 8, 2026 |
| GHSA-32vr-5gcf-3pw2PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition LoadingAlso filed as CVE-2026-39890, PYSEC-2026-462 | critical | Affected | Apr 8, 2026 |
| GHSA-r9x3-wx45-2v7fPraisonAI recipe registry publish path traversal allows out-of-root file writeAlso filed as CVE-2026-39308, PYSEC-2026-2922 | high | Affected | Apr 6, 2026 |
| GHSA-4rx4-4r3x-6534PraisonAI recipe registry pull path traversal writes files outside the chosen output directoryAlso filed as CVE-2026-39306, PYSEC-2026-2900 | high | Affected | Apr 6, 2026 |
| GHSA-jfxc-v5g9-38xrPraisonAI Vulnerable to Arbitrary File Write / Path Traversal in Action OrchestratorAlso filed as CVE-2026-39305, PYSEC-2026-475 | critical | Affected | Apr 6, 2026 |
| GHSA-4ph2-f6pf-79wvPraisonAI Has Arbitrary File Write (Zip Slip) in Templates ExtractionAlso filed as CVE-2026-39307, PYSEC-2026-2899 | high | Affected | Apr 6, 2026 |
| GHSA-98f9-fqg5-hvq5PraisonAI Has Authentication Bypass via OAuthManager.validate_token()Also filed as CVE-2026-34953, PYSEC-2026-468 | critical | Affected | Apr 1, 2026 |
| GHSA-cfh6-vr3j-qc3gPraisonAI Has Missing Authentication in WebSocket GatewayAlso filed as CVE-2026-34952, PYSEC-2026-474 | critical | Affected | Apr 1, 2026 |
| GHSA-r4f2-3m54-pp7qPraisonAI Has Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandboxAlso filed as CVE-2026-34955, PYSEC-2026-2921 | high | Affected | Apr 1, 2026 |
| GHSA-x6m9-gxvr-7jpvPraisonAI: SSRF via Unvalidated api_base in passthrough() FallbackAlso filed as CVE-2026-34936, PYSEC-2026-2924 | high | Affected | Apr 1, 2026 |
| GHSA-8w9j-hc3g-3g7fPraisonAI Has ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools()Also filed as CVE-2026-34939, PYSEC-2026-2907 | medium | Affected | Apr 1, 2026 |
| GHSA-9cq8-3v94-434gPraisonAI Has Second-Order SQL Injection in `get_all_user_threads`Also filed as CVE-2026-34934, PYSEC-2026-470 | critical | Affected | Apr 1, 2026 |
| CVE-2026-57139PraisonAI is a multi-agent teams system. From 1.5.0 until 1.7.2, MCPServer.startHttp() in src/praisonai-ts/src/mcp/server.ts binds without a host restriction and forwards every HTTP POST request to handleRequest() without authentication or authoriza… | critical | Not checked | Sep 15, 2026 |
| GHSA-7ww9-85pg-cv4xPraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent executionAlso filed as CVE-2026-55534, PYSEC-2026-3887 | high | Not flagged | Aug 25, 2026 |
| GHSA-hxmv-c4g6-5fqcPraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe codeAlso filed as CVE-2026-55522, PYSEC-2026-3891, PYSEC-2026-3903 | high | Not flagged | Aug 25, 2026 |
| GHSA-6jcq-6546-qrrwPraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailableAlso filed as CVE-2026-57144, PYSEC-2026-3504 | high | Not flagged | Jun 18, 2026 |
| GHSA-jxcw-qp4h-6jfqPraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by defaultAlso filed as CVE-2026-57146, PYSEC-2026-3515 | high | Not flagged | Jun 18, 2026 |
| GHSA-7qw2-w5rc-37x2PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yamlAlso filed as CVE-2026-57142, PYSEC-2026-3505 | high | Not flagged | Jun 18, 2026 |
| GHSA-f44v-7qgw-9gh9PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletionAlso filed as CVE-2026-57113, PYSEC-2026-3509 | high | Not flagged | Jun 18, 2026 |
| GHSA-892r-p3jq-jp24PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocationAlso filed as CVE-2026-57116, PYSEC-2026-3507 | critical | Not flagged | Jun 18, 2026 |
| GHSA-rjvw-7vvw-549vPraisonAI: Jobs webhook SSRF protection bypass via DNS rebindingAlso filed as CVE-2026-57114, PYSEC-2026-3519 | high | Not flagged | Jun 18, 2026 |
| GHSA-w6h2-fr4q-xvxvPraisonAI: Compute-bridged file tools allow shell command injectionAlso filed as CVE-2026-57117, PYSEC-2026-3522 | high | Not flagged | Jun 18, 2026 |
| GHSA-v847-hxxw-3pxgPraisonAI recipe.run_stream skips dangerous-tool policy enforcementAlso filed as CVE-2026-56838, PYSEC-2026-3520 | high | Not flagged | Jun 18, 2026 |
| GHSA-63v4-w882-g4x2PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous toolsAlso filed as CVE-2026-56840, PYSEC-2026-3503 | high | Not flagged | Jun 18, 2026 |
| GHSA-fc26-m9pf-v56qPraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missingAlso filed as CVE-2026-56837, PYSEC-2026-3510 | high | Not flagged | Jun 18, 2026 |
| GHSA-j7qx-p75m-wp7gPraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storageAlso filed as CVE-2026-56834, PYSEC-2026-3514 | high | Not flagged | Jun 18, 2026 |
| GHSA-qvpf-j64c-jmhrPraisonAI Slack app_mention bypasses configured user/channel authorizationAlso filed as CVE-2026-56835, PYSEC-2026-3518 | high | Not flagged | Jun 18, 2026 |
| GHSA-5qw8-f2g9-ff29PraisonAI recipe serve Typer command bypasses the non-localhost authentication guardAlso filed as CVE-2026-56836, PYSEC-2026-3502 | high | Not flagged | Jun 18, 2026 |
| GHSA-vmf9-xx9w-86wxPraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered toolsAlso filed as CVE-2026-57112, PYSEC-2026-3521, PYSEC-2026-3534 | high | Not flagged | Jun 18, 2026 |
| GHSA-22cj-m4wf-fv2cPraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversalAlso filed as CVE-2026-56833, PYSEC-2026-3499 | high | Not flagged | Jun 18, 2026 |
| GHSA-8579-rgg5-ph2mPraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvalsAlso filed as CVE-2026-56832, PYSEC-2026-3506 | high | Not flagged | Jun 18, 2026 |
| GHSA-3643-7v76-5cj2PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queriesAlso filed as CVE-2026-44337, PYSEC-2026-2897 | medium | Not flagged | May 11, 2026 |
| GHSA-6rmh-7xcm-cpxjPraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow executionAlso filed as CVE-2026-44338, PYSEC-2026-2904 | high | Not flagged | May 11, 2026 |
| GHSA-xcmw-grxf-wjhjPraisonAI has unauthenticated RCE via `tool_override.py` (CVE-2026-40287 patch bypass)Also filed as CVE-2026-44334, PYSEC-2026-2926 | high | Not flagged | May 6, 2026 |
| GHSA-99g3-w8gr-x37cPraisonAI vulnerable to arbitrary file write via path traversal in `praisonai recipe unpack`Also filed as CVE-2026-40157, PYSEC-2026-469 | critical | Not flagged | Apr 10, 2026 |
| GHSA-693f-pf34-72c5PraisonAI Has Path Traversal in FileToolsAlso filed as CVE-2026-35615, PYSEC-2026-464 | critical | Not flagged | Apr 6, 2026 |
| GHSA-9gm9-c8mq-vq7mPraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()Also filed as CVE-2026-34935, PYSEC-2026-471 | critical | Not flagged | Apr 1, 2026 |
Versions in the registry
2.3.42 (listed)