Vulnerabilities

TI-2026-79620 CVE-2026-57117

OS command injection in PraisonAI compute-bridged file tools

HIGH 73

PraisonAI is a multi-agent teams system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00581 Published 2026-10-23 Fixed in 4.6.59 CWE-78

TI-2026-79624 CVE-2026-57146

Missing authentication in PraisonAI A2U event routes by default

HIGH 72

PraisonAI is a multi-agent teams system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0049 Published 2026-10-23 Fixed in 4.6.61 CWE-200

TI-2026-79623 CVE-2026-57144

PraisonAI SandlockSandbox drops filesystem and network limits

HIGH 73

PraisonAI is a multi-agent teams system.

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.00207 Published 2026-10-23 Fixed in 4.6.61 CWE-266

TI-2026-79622 CVE-2026-57142

PraisonAI recipe policy bypass lets recipes run shell commands

HIGH 69

PraisonAI is a multi-agent teams system.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.0024 Published 2026-10-23 Fixed in 4.6.61 CWE-78

TI-2026-79621 CVE-2026-57121

PraisonAI DELETE endpoints let members delete others' content

LOW 35

PraisonAI is a multi-agent teams system.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00329 Published 2026-10-23 Fixed in 0.1.5, 0.1.6 CWE-285

TI-2026-79619 CVE-2026-57116

Missing authentication in PraisonAI AgentOS exposes agent chat

HIGH 82

PraisonAI is a multi-agent teams system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00416 Published 2026-10-23 Fixed in 4.6.59 CWE-200

TI-2026-79618 CVE-2026-57114

SSRF protection bypass in PraisonAI Jobs webhooks via DNS rebinding

HIGH 71

PraisonAI is a multi-agent teams system.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00264 Published 2026-10-23 Fixed in 4.6.59 CWE-367

TI-2026-79617 CVE-2026-57113

Path traversal in PraisonAI template cache allows outside file write

LOW 35

PraisonAI is a multi-agent teams system.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00405 Published 2026-10-23 Fixed in 4.6.59 CWE-22

TI-2026-79616 CVE-2026-56840

Cross-site scripting in PraisonAI approval page enables tool approval

HIGH 73

PraisonAI is a multi-agent teams system.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00375 Published 2026-10-23 Fixed in 4.6.59 CWE-79

TI-2026-79615 CVE-2026-56838

Dangerous-tool policy skipped in PraisonAI recipe.run_stream

HIGH 69

PraisonAI is a multi-agent teams system.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00146 Published 2026-10-23 Fixed in 4.6.59 CWE-693

TI-2026-79614 CVE-2026-56837

PraisonAI LinearBot accepts unsigned webhooks when secret is unset

MEDIUM 42

PraisonAI is a multi-agent teams system.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00188 Published 2026-10-23 Fixed in 4.6.59 CWE-287

TI-2026-79613 CVE-2026-56836

Missing authentication in PraisonAI recipe serve command exposes API

HIGH 75

PraisonAI is a multi-agent teams system.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00329 Published 2026-10-23 Fixed in 4.6.59 CWE-287

TI-2026-79612 CVE-2026-56835

PraisonAI Slack app_mention events bypass user and channel checks

HIGH 71

PraisonAI is a multi-agent teams system.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00215 Published 2026-10-23 Fixed in 4.6.59 CWE-862

TI-2026-79611 CVE-2026-56834

PraisonAI artifact tools read host files outside artifact storage

HIGH 72

PraisonAI is a multi-agent teams system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00373 Published 2026-10-23 Fixed in 4.6.59 CWE-200

TI-2026-79610 CVE-2026-56833

Path traversal in PraisonAI Dynamic Context tools reads external files

LOW 39

PraisonAI is a multi-agent teams system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0046 Published 2026-10-23 Fixed in 4.6.59 CWE-200

TI-2026-79609 CVE-2026-56832

PraisonAI Discord approval accepts unrelated messages as approvals

HIGH 73

PraisonAI is a multi-agent teams system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00148 Published 2026-10-23 Fixed in 4.6.59 CWE-345

TI-2026-71236 CVE-2026-57118

Missing access control in PraisonAI AgentTeam exposes agent endpoints

HIGH 82

PraisonAI is a multi-agent teams system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00413 Published 2026-10-12 Fixed in 4.6.59, 1.6.59 CWE-306

TI-2026-71237 CVE-2026-57143

Server-side request forgery in PraisonAI SearxNG search tools

HIGH 71

PraisonAI is a multi-agent teams system.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00275 Published 2026-10-12 Fixed in 1.6.62, 1.6.61 CWE-20

TI-2026-69211 CVE-2026-62176 · GHSA-g6j7-pffp-8whg

Code injection in PraisonAI deploy API server generation

HIGH 74

PraisonAI is a multi-agent teams system.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.0046 Published 2026-10-07 Fixed in 4.6.78 CWE-94

TI-2026-69153 CVE-2026-62179 · GHSA-mxmx-rh57-jx58

PraisonAI: members can delete owner issue dependencies via related issues

LOW 28

PraisonAI is a multi-agent teams system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00175 Published 2026-10-07 Fixed in 0.1.9 CWE-862

TI-2026-41122 CVE-2026-57147 · GHSA-cwj8-7gp2-ggcw

praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery

HIGH 82

PraisonAI is a multi-agent teams system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00772 Published 2026-09-15 Fixed in 4.6.51, 0.1.6 CWE-1188

TI-2026-41123 CVE-2026-57148 · GHSA-f38v-77qj-h4jq

praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)

HIGH 82

PraisonAI is a multi-agent teams system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00641 Published 2026-09-15 Fixed in 4.6.51, 0.1.6 CWE-1188

TI-2026-41119 CVE-2026-57140 · GHSA-9752-mhqh-h34f

PraisonAI AgentOS exposes unauthenticated agent listing and invocation

MEDIUM 49

PraisonAI is a multi-agent teams system.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.00642 Published 2026-09-15 Fixed in 1.7.2 CWE-306

TI-2026-41118 CVE-2026-57139 · GHSA-j4f3-55x4-r6q2

PraisonAI MCPServer exposes unauthenticated HTTP tools/call

HIGH 82

PraisonAI is a multi-agent teams system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00754 Published 2026-09-15 Fixed in 1.7.2 CWE-1188

TI-2026-41112 CVE-2026-57133 · GHSA-5jv7-2mjm-h6qj

PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining

HIGH 73

PraisonAI is a multi-agent teams system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00804 Published 2026-09-15 Fixed in 1.7.2 CWE-693

Vulnerabilities

Filters