| PraisonAI Vulnerable to Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-varsCVE-2026-40113 · GHSA-FVXX-GGMX-3CJGVersion ranges need review. |
praisonai |
PyPI |
High
|
Fix reported |
|
| PraisonAI vulnerable to Remote Code Execution via Broken AST SandboxCVE-2026-61438 · GHSA-26MH-57Q7-JFVR |
praisonai |
PyPI |
High
|
Fix reported |
|
| PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDLCVE-2026-60090 · GHSA-WF65-4JJX-Q444Version ranges need review. |
praisonai |
PyPI |
Medium
|
Fix reported |
|
| PraisonAI: Prompt-injection defense blocks only when 3+ detector families fire simultaneously; realistic single-vector injections pass through unblockedCVE-2026-60086 · GHSA-4R3P-W3MC-5V34Version ranges need review. |
praisonai |
PyPI |
Medium
|
Fix reported |
|
| PraisonAI: Call API localhost-only authentication bypass via spoofed Host headerCVE-2026-61435 · GHSA-2GPF-2492-Q9JHVersion ranges need review. |
praisonai |
PyPI |
High
|
Fix reported |
|
| PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool CallsCVE-2026-61445 · GHSA-9MP3-24CC-77MGVersion ranges need review. |
praisonai |
PyPI |
Critical
|
Fix reported |
|
| PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofingCVE-2026-61428 · GHSA-QJ9C-59P6-8CGXVersion ranges need review. |
praisonai |
PyPI |
High
|
Fix reported |
|
| PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRFCVE-2026-60091 · GHSA-4W49-GWV8-FPJGVersion ranges need review. |
praisonai |
PyPI |
High
|
Fix reported |
|
| PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backendCVE-2026-60085 · GHSA-5R6C-GJ4G-R697Version ranges need review. |
praisonai |
PyPI |
High
|
Fix reported |
|
| PraisonAI: Shell command allowlist bypass via find -exec built-in actionCVE-2026-61434 · GHSA-CV3G-HJ65-PCFHVersion ranges need review. |
praisonai |
PyPI |
High
|
Fix reported |
|
| PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspaceCVE-2026-61431 · GHSA-Q7M5-3JMV-VM48Version ranges need review. |
praisonai |
PyPI |
Medium
|
Fix reported |
|
| PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surfaceCVE-2026-61427 · GHSA-HC5V-GXVJ-58WHVersion ranges need review. |
praisonai |
PyPI |
High
|
Fix reported |
|
| PraisonAI: API deploy code generator embeds unescaped YAML fields into Python sourceCVE-2026-61433 · GHSA-79FV-7HQ9-W7XGVersion ranges need review. |
praisonai |
PyPI |
High
|
Fix reported |
|
| PraisonAI: Project custom command templates can read outside-workspace files into model promptsCVE-2026-60088 · GHSA-XPX6-X8C2-MW5WVersion ranges need review. |
praisonai |
PyPI |
Medium
|
Fix reported |
|
| PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agentsCVE-2026-61436 · GHSA-7C92-X8VG-4258Version ranges need review. |
praisonai |
PyPI |
High
|
Fix reported |
|
| PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level ThreatsCVE-2026-61439 · GHSA-FJ8F-M44G-C479Version ranges need review. |
praisonai |
PyPI |
High
|
Fix reported |
|
| PraisonAI: Code Injection via f-string Interpolation in Deploy API Server GenerationCVE-2026-62176 · GHSA-G6J7-PFFP-8WHG |
praisonai |
PyPI |
Critical
|
Fix reported |
|
| PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secretCVE-2026-55533 · GHSA-GFQ8-HMPH-9GJVVersion ranges need review. |
praisonai |
PyPI |
High
|
Fix reported |
|
| PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe codeCVE-2026-55522 · GHSA-HXMV-C4G6-5FQCVersion ranges need review. |
praisonaipraisonaiagents |
PyPI |
High
|
Fix reported |
|
| PraisonAI vulnerable to Server-Side Request Forgery via DNS rebinding bypass in webhook_url validationCVE-2026-55535 · GHSA-HMFX-4V44-9QW9Version ranges need review. |
praisonai |
PyPI |
Medium
|
Fix reported |
|
