Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: MervinPraison PraisonAI 1.6.78 Clear all filters
TI-2026-44051 CVE-2026-61446 · GHSA-m6wp-h223-4c8g · GHSA-q359-rmv4-56fg

PraisonAI before 1.6.78 Remote Code Execution via Plugin Auto-Discovery

Priority LOW 39

PraisonAI (praisonaiagents) before 1.6.78 contains a remote code execution vulnerability in the plugin manager, which loads and executes arbitrary Python (.py) files from project-level and user-home .praisonai/plugins/ d…

CVSS 4.0HIGH 8.6 Local No auth No interaction EPSS 0.00339 Published 2026-07-15 Fixed in 1.6.78 CWE-94
TI-2026-44048 CVE-2026-61443 · GHSA-c44f-37qr-gw3f · GHSA-f352-4x87-wmjh

PraisonAI before 1.6.78 Remote Code Execution via SkillTools

Priority HIGH 72

PraisonAI before 1.6.78 contains a remote code execution vulnerability in SkillTools.run_skill_script() that executes scripts without path containment validation.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.0064 Published 2026-07-15 Fixed in 1.6.78 CWE-22
TI-2026-44035 CVE-2026-61430 · GHSA-92x2-g374-gcvx · GHSA-qg25-6gc4-48mg

PraisonAI before 1.6.78 DNS Rebinding SSRF via web_crawl

Priority HIGH 70

PraisonAI before 1.6.78 contains a server-side request forgery vulnerability in the web_crawl tool that validates hostnames at check time but re-resolves them at connection time without IP pinning.

CVSS 4.0HIGH 8.4 Network Low privileges No interaction EPSS 0.00253 Published 2026-07-15 Fixed in 1.6.78 CWE-918
TI-2026-42817 CVE-2026-60087 · GHSA-29r9-67vg-qj56 · GHSA-r3xw-gcpr-rf26

PraisonAI before 1.6.78 Tool Approval Cache Bypass

Priority MEDIUM 64

PraisonAI before 1.6.78 caches tool approval decisions by tool name only, allowing attackers to reuse initial approvals for subsequent calls with arbitrary arguments.

CVSS 4.0MEDIUM 6.9 Local No auth User interaction EPSS 0.00337 Published 2026-07-15 Fixed in 1.6.78 CWE-863