MervinPraison

Records178All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical50CVSS 9.0–10.0

CVSS high100CVSS 7.0–8.9

Exploited now

MervinPraison records in CISA KEV

No MervinPraison vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Praisonai 43 records HIGH Praisonaiagents 15 records HIGH

Records

43 records in Praisonai · all components

TI-2026-30083 CVE-2026-41497 · GHSA-9qhq-v63v-fv3j

Incomplete fix for CVE-2026-34935: Command Injection in MervinPraison/PraisonAI

HIGH 82

PraisonAI is a multi-agent teams system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00541 Published 2026-05-08 Fixed in 4.6.9, 4.5.149 CWE-77

TI-2026-29070 CVE-2026-40288 · GHSA-vc46-vw85-3wvm

PraisonAI: Critical RCE via `type: job` workflow YAML

HIGH 82

PraisonAI is a multi-agent teams system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00609 Published 2026-04-14 Fixed in 4.5.139, 1.5.140 CWE-78

TI-2026-28940 CVE-2026-40114 · GHSA-8frj-8q3m-xhgm

PraisonAI has Server-Side Request Forgery via Unvalidated webhook_url in Jobs API

HIGH 82

PraisonAI is a multi-agent teams system.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00239 Published 2026-04-09 Fixed in 4.5.128 CWE-918

TI-2026-28768 CVE-2026-39890 · GHSA-32vr-5gcf-3pw2

PraisonAI Affected by Remote Code Execution via YAML Deserialization in Agent Definition Loading

HIGH 82

PraisonAI is a multi-agent teams system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00589 Published 2026-04-08 Fixed in 4.5.115 CWE-502

TI-2026-27159 CVE-2026-34935 · GHSA-9gm9-c8mq-vq7m

PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()

HIGH 82

PraisonAI is a multi-agent teams system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00839 Published 2026-04-03 Fixed in 4.5.69 CWE-78

TI-2026-27158 CVE-2026-34934 · GHSA-9cq8-3v94-434g

PraisonAI: Second-Order SQL Injection in `get_all_user_threads`

HIGH 82

PraisonAI is a multi-agent teams system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00543 Published 2026-04-03 Fixed in 4.5.90 CWE-89

TI-2026-29071 CVE-2026-40289 · GHSA-8x8f-54wf-vv92

PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions

HIGH 80

PraisonAI is a multi-agent teams system.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00421 Published 2026-04-14 Fixed in 4.5.139, 1.5.140 CWE-306

TI-2026-27176 CVE-2026-34952 · GHSA-cfh6-vr3j-qc3g

PraisonAI: Missing Authentication in WebSocket Gateway

HIGH 80

PraisonAI is a multi-agent teams system.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00452 Published 2026-04-03 Fixed in 4.5.97 CWE-306

TI-2026-27716 CVE-2026-35615 · GHSA-693f-pf34-72c5

PraisonAI has a Path Traversal in FileTools

HIGH 79

PraisonAI is a multi-agent teams system.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00432 Published 2026-04-07 Fixed in 4.5.113, 1.5.113 CWE-22

TI-2026-27177 CVE-2026-34953 · GHSA-98f9-fqg5-hvq5

PraisonAI: Authentication Bypass in OAuthManager.validate_token()

HIGH 78

PraisonAI is a multi-agent teams system.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0039 Published 2026-04-03 Fixed in 4.5.97 CWE-863

TI-2026-32306 CVE-2026-44339 · GHSA-gmjg-hv98-qggq

PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `main` callables execute

HIGH 76

PraisonAI is a multi-agent teams system.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00363 Published 2026-05-08 Fixed in 1.6.37, 4.6.37 CWE-470

TI-2026-32303 CVE-2026-44336 · GHSA-9mqq-jqxf-grvw

PraisonAI MCP `tools/call` path-traversal and RCE via Python `.pth` injection

HIGH 76

PraisonAI is a multi-agent teams system.

CVSS 4.0CRITICAL 9.4 Network No auth User interaction EPSS 0.0062 Published 2026-05-08 Fixed in 4.6.34 CWE-20

TI-2026-28972 CVE-2026-40157 · GHSA-99g3-w8gr-x37c

PraisonAI affected by arbitrary file write via path traversal in `praisonai recipe unpack`

HIGH 76

PraisonAI is a multi-agent teams system.

CVSS 4.0CRITICAL 9.4 Network No auth User interaction EPSS 0.00385 Published 2026-04-10 Fixed in 4.5.128 CWE-22

TI-2026-28969 CVE-2026-40154 · GHSA-pv9q-275h-rh7x

PraisonAI Affected by Untrusted Remote Template Code Execution

HIGH 76

PraisonAI is a multi-agent teams system.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00309 Published 2026-04-09 Fixed in 4.5.128 CWE-829

TI-2026-28916 CVE-2026-40088 · GHSA-2763-cj5r-c79m

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai

HIGH 76

PraisonAI is a multi-agent teams system.

CVSS 3.1CRITICAL 9.7 Network No auth User interaction EPSS 0.00426 Published 2026-04-09 Fixed in 4.5.121 CWE-78

TI-2026-28766 CVE-2026-39888 · GHSA-qf73-2hrx-xprp

PraisonAIAgents has a sandbox escape via exception frame traversal in `execute_code` (subprocess mode)

HIGH 76

PraisonAI is a multi-agent teams system.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00504 Published 2026-04-08 Fixed in 1.5.115 CWE-657

TI-2026-28295 CVE-2026-39305 · GHSA-jfxc-v5g9-38xr

Arbitrary File Write / Path Traversal in Action Orchestrator

HIGH 76

PraisonAI is a multi-agent teams system.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00318 Published 2026-04-07 Fixed in 4.5.113 CWE-22

TI-2026-27179 CVE-2026-34955 · GHSA-r4f2-3m54-pp7q

PraisonAI: Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandbox

HIGH 76

PraisonAI is a multi-agent teams system.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.0039 Published 2026-04-03 Fixed in 4.5.97 CWE-78

TI-2026-28769 CVE-2026-39891 · GHSA-hwg5-x759-7wjg

PraisonAI has a Template Injection in Agent Tool Definitions

HIGH 73

PraisonAI is a multi-agent teams system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00569 Published 2026-04-08 Fixed in 4.5.115 CWE-94

TI-2026-29069 CVE-2026-40287 · GHSA-g985-wjh9-qxxc

PraisonAI has RCE via Automatic tools.py Import

HIGH 72

PraisonAI is a multi-agent teams system.

CVSS 3.1HIGH 8.4 Local No auth No interaction EPSS 0.00246 Published 2026-04-14 Fixed in 4.5.139, 1.5.140 CWE-426

TI-2026-28973 CVE-2026-40158 · GHSA-3c4r-6p77-xwr7

PraisonAI has Improper Control of Generation of Code ('Code Injection') and Protection Mechanism Failure in praisonai

HIGH 72

PraisonAI is a multi-agent teams system.

CVSS 3.1HIGH 8.6 Local No auth User interaction EPSS 0.00244 Published 2026-04-10 Fixed in 4.5.128 CWE-693

TI-2026-28942 CVE-2026-40116 · GHSA-q5r4-47m9-5mc7

PraisonAI's Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate Limits

HIGH 72

PraisonAI is a multi-agent teams system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00387 Published 2026-04-09 Fixed in 4.5.128 CWE-770

TI-2026-28939 CVE-2026-40113 · GHSA-fvxx-ggmx-3cjg

PraisonAI has an Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars

HIGH 72

PraisonAI is a multi-agent teams system.

CVSS 3.1HIGH 8.4 Local Low privileges No interaction EPSS 0.00235 Published 2026-04-09 Fixed in 4.5.128 CWE-88

TI-2026-32305 CVE-2026-44338 · GHSA-6rmh-7xcm-cpxj

Missing authentication in MervinPraison PraisonAI

HIGH 71

PraisonAI is a multi-agent teams system.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.32591 Published 2026-05-08 Fixed in 4.6.34 CWE-1188

TI-2026-30082 CVE-2026-41496 · GHSA-rg3h-x3jw-7jm5

SQL injection in MervinPraison PraisonAI

HIGH 70

PraisonAI is a multi-agent teams system.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00347 Published 2026-05-08 Fixed in 4.5.149, 1.6.8 CWE-89

Open these records in search →