These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-05T20:17:10.847Z and has not been modified since then. The web_crawl tool in PraisonAI versions prior to 1.6.58 performs SSRF checks only on the initially supplied URL, allowing potential bypass through HTTP redirects and DNS rebinding. This issue may impact organizations using PraisonAI for web cra [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-05T20:17:10.453Z and has not been modified since then. This vulnerability affects PraisonAI versions 3.9.26 through 4.6.57 and 0.12.12 through 1.6.57, allowing for arbitrary Python code execution due to a vulnerability in the workflow 'include' feature. Users should be aware of the potential impact [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-05T19:17:31.070Z and has not been modified since then. The vulnerability is a command injection issue in the Claude GitHub Actions workflow of PraisonAI versions prior to 4.6.40. This vulnerability allows for arbitrary shell code execution in the GitHub Actions runner due to improper quoting or vali [truncated]
CVE-2026-47419 is an Insecure Direct Object Reference vulnerability in PraisonAI Platform versions prior to 0.1.4. The agent CRUD endpoints gate access on workspace membership only, then resolve agent IDs through a primary-key lookup with no workspace constraint. This allows users who are members of any workspace to read, modify, or delete agents from a different workspace by guessing or harvesting an age [truncated]
CVE-2026-47418 is an Insecure Direct Object Reference vulnerability in PraisonAI Platform versions prior to 0.1.4. The project CRUD endpoints gate access on workspace membership only, then resolve project IDs without constraining lookups by workspace ID. This allows a user who is a member of any workspace W1 to read, modify, delete, or read stats for projects that belong to a different workspace W2. The v [truncated]
CVE-2026-47416 is a critical vulnerability in PraisonAI Platform versions prior to 0.1.4. The vulnerability allows for vertical privilege escalation via the PATCH /workspaces/{workspace_id}/members/{user_id} endpoint. This endpoint is gated by require_workspace_member(workspace_id), which defaults to min_role='member' and is never overridden by the route. The handler then calls MemberService.update_role(w [truncated]
CVE-2026-47413 is a critical vulnerability in PraisonAI Platform versions prior to 0.1.4, allowing for privilege escalation and cross-tenant member injection. The vulnerability exists in the `POST /workspaces/{workspace_id}/members` endpoint, which is gated only by `require_workspace_member(workspace_id)` and forwards the request body's `user_id` and `role` straight into `MemberService.add(workspace_id, u [truncated]
CVE-2026-47412 is an authorization bypass vulnerability in PraisonAI Platform versions prior to 0.1.4. The DELETE /workspaces/{workspace_id} endpoint is gated only by require_workspace_member(workspace_id) (default min_role='member'). Any member of the workspace can issue a single DELETE to wipe the entire workspace, including every project, issue, comment, agent, label, and member record (cascading via f [truncated]
CVE-2026-47410 is a critical vulnerability in PraisonAI Platform versions prior to 0.1.4. The platform's JWT signing secret defaults to a hardcoded literal 'dev-secret-change-me' when PLATFORM_JWT_SECRET is unset. A safety check exists but only fires when PLATFORM_ENV != 'dev'; the default value of PLATFORM_ENV is 'dev', so the check is silently bypassed in any deployment that does not explicitly opt out. [truncated]
CVE-2026-47407 is a critical vulnerability in PraisonAI Platform version prior to 0.1.4. The Platform server exposes resources under `/api/v1/workspaces/{workspace_id}/...` and protects them with a `require_workspace_member(workspace_id)` FastAPI dependency. However, this dependency only checks if the caller is a member of the workspace_id in the URL prefix, not the resource's own workspace_id. This allow [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T17:17:08.950Z and has not been modified since then. PraisonAI Platform versions prior to 0.1.4 contain a systemic object-level authorization flaw in workspace-scoped REST routes. This flaw allows an authenticated user from one workspace to access, modify, or delete objects from another workspace [truncated]
CVE-2026-47396 is a critical vulnerability in PraisonAI's call server, affecting the `praisonai.api.agent_invoke` component. The vulnerability allows unauthorized access to sensitive agent-control endpoints when `CALL_SERVER_TOKEN` is not configured. This issue is particularly concerning as the bundled call server binds to `0.0.0.0`, making it accessible to any client on the network. The vulnerability has [truncated]
CVE-2026-47393 is a critical vulnerability in PraisonAI, a multi-agent teams system. The issue arises from a code-generator that creates a Flask API server with authentication disabled by default. This affects users who follow the quickstart guide and deploy the API server binding to 0.0.0.0, exposing endpoints like /chat and /agents. The server runs praisonai.run() on user-supplied JSON input, which incl [truncated]
CVE-2026-47390 is a server-side request forgery (SSRF) protection bypass vulnerability in PraisonAI, a multi-agent teams system. The vulnerability exists in the `spider_tools` URL validation function, which can be bypassed using alternate loopback host encodings. This allows an attacker to induce SSRF requests against loopback-only services. The vulnerability was patched in PraisonAI version 4.6.40 and pr [truncated]
CVE-2026-61440: PraisonAI Platform before 0.1.9 has a vulnerability that allows workspace members to rename and recolor shared labels and add or remove labels on owner-created issues. This is due to a lack of proper authorization for label and issue-label mutations. The vulnerability has a CVSS score of 7.1 and is classified as HIGH severity. Users of PraisonAI Platform before version 0.1.9 should be awar [truncated]
CVE-2026-61427 is a vulnerability in PraisonAI before version 4.6.78. The MCP HTTP-stream transport is exposed without authentication by default. The CLI --api-key option defaults to None, and the server only enforces Authorization/Bearer checks when an API key is configured. An unauthenticated client can initialize a session, enumerate available tools, and invoke tools without an API key. The dispatcher [truncated]
CVE-2026-61447 is a remote code execution vulnerability in PraisonAI before version 1.6.78. The vulnerability is caused by the CodeAgent._execute_python() function executing LLM-generated Python code without AST validation, import restrictions, or sandbox enforcement. Attackers can influence LLM output through prompt injection to exfiltrate all environment secrets and execute arbitrary code on the host sy [truncated]
CVE-2026-61445 is a critical vulnerability in PraisonAI before version 4.6.78, affecting the AICoder component. The vulnerability is characterized by arbitrary file write and command execution attacks due to missing path validation and command sanitization in LLM tool calls. Attackers can exploit this by injecting malicious prompts through the chat interface, allowing them to write files to arbitrary file [truncated]
CVE-2026-61439 is a high-severity vulnerability in PraisonAI versions before 4.6.78. The vulnerability is caused by a prompt injection defense misconfiguration, where the block threshold defaults to CRITICAL severity, allowing HIGH-level threats to pass through unblocked. This could enable attackers to submit single-vector prompt injection attacks, such as instruction overrides or financial manipulation, [truncated]
CVE-2026-61426 involves PraisonAI, a tool that offers AI functionalities. The vulnerability arises from its insecure default configuration, which binds to all interfaces without requiring an API key and with wildcard CORS enabled. This setup allows unauthenticated attackers to access certain endpoints, such as GET /api/agents to read agent instructions and system prompts, or POST /api/chat to invoke agents.
CVE-2026-60088 is a path traversal vulnerability in PraisonAI before version 4.6.78. The vulnerability allows attackers to read files outside the workspace by including path traversal sequences or absolute paths in project command files. This could potentially lead to the exfiltration of sensitive information. Users of PraisonAI before version 4.6.78 should be aware of this vulnerability and take steps to [truncated]
CVE-2026-61444 is a critical code injection vulnerability in PraisonAI versions before 4.6.78. The vulnerability exists in deploy/api.py where the agents_file parameter is directly interpolated into an f-string without sanitization. Attackers can inject arbitrary Python code that executes when the generated server code runs via subprocess.Popen(). This vulnerability has a CVSS score of 9.4 and is consider [truncated]
CVE-2026-61441 is a high-severity vulnerability in PraisonAI Platform versions before 0.1.9. It allows members to bypass owner/admin authorization and remove owner-created issue dependencies by targeting related member-owned issue endpoints. This occurs because permission is validated against the member-owned issue's owner. Users of PraisonAI Platform versions before 0.1.9 should apply the patch to preven [truncated]
CVE-2026-61437 is a high-severity vulnerability in PraisonAI (pip package praisonaiagents) before version 1.6.78. The vulnerability is caused by an unsafe dynamic module loading mechanism in AgentFlow._resolve_pydantic_class (src/praisonai-agents/praisonaiagents/workflows/workflows.py). This allows an attacker to execute arbitrary Python code with the workflow runner's privileges when the workflow is exec [truncated]
A path traversal vulnerability exists in PraisonAI (praisonaiagents) before 1.6.78 in the FastContext feature (praisonaiagents.context.fast). The vulnerability allows attackers to read, search, and enumerate files outside the intended workspace directory, potentially leading to unauthorized access to sensitive information. Users of PraisonAI (praisonaiagents) before version 1.6.78 should apply the patch t [truncated]
CVE-2026-61431 is a path traversal vulnerability in PraisonAI's ContextGatherer component. The vulnerability occurs due to insufficient validation of include paths in .praisoncontext and .praisoninclude files. This allows attackers to supply absolute paths or parent directory traversal sequences, enabling them to read arbitrary files outside the workspace and include their contents in the generated contex [truncated]
CVE-2026-60091 is a medium-severity vulnerability in PraisonAI before version 4.6.78, allowing unauthenticated server-side request forgery via the Jobs API /api/v1/runs endpoint. The vulnerability is caused by the webhook_url parameter being validated at request time but re-resolved at connection time, enabling attackers to use DNS rebinding for a blind SSRF attack on internal services.
CVE-2026-60089 is a path traversal vulnerability in PraisonAI, a pip package for AI agents. Versions before 1.6.78 are affected. The vulnerability allows an untrusted checked-out project to overwrite files outside the project root with the privileges of the user running PraisonAI. This is possible because PraisonAI automatically loads defaults from a project-local .praisonai/config.toml file and does not [truncated]
CVE-2026-60086 is a medium-severity vulnerability in PraisonAI before version 4.6.78, allowing attackers to bypass the prompt injection defense mechanism. The defense only blocks threats classified as CRITICAL, requiring three or more detector families to match simultaneously. This allows attackers to craft HIGH-level threat injections that can bypass the defense and reach the model. Security teams and ad [truncated]
A vulnerability was discovered in PraisonAI's SubprocessSandbox feature, which allows for trivial sandbox escape in STRICT mode. The issue arises from the use of subprocess.run() with shell=True and inadequate string-pattern matching to block dangerous commands. Specifically, the blocklist does not include sh or bash as standalone executables, permitting an attacker to execute arbitrary commands using sh [truncated]
CVE-2026-34954 is a vulnerability in the PraisonAI multi-agent teams system, specifically in the FileTools.download_file() function. Prior to version 1.5.95, this function validates the destination path but does not validate the URL parameter, passing it directly to httpx.stream() with follow_redirects=True. This allows an attacker who controls the URL to reach any host accessible from the server, includi [truncated]
CVE-2026-34953 is a critical vulnerability in PraisonAI's OAuthManager.validate_token() function. Prior to version 4.5.97, the function returns True for any token not found in its internal store, which is empty by default. This allows any HTTP request to the MCP server with an arbitrary Bearer token to be treated as authenticated, granting full access to all registered tools and agent capabilities. The is [truncated]
CVE-2026-34952 is a critical vulnerability in PraisonAI, a multi-agent teams system. The PraisonAI Gateway server accepts WebSocket connections at /ws and serves agent topology at /info without authentication. This allows any network client to connect, enumerate registered agents, and send arbitrary messages to agents and their tool sets. The issue has been patched in version 4.5.97. Users and administrat [truncated]
A vulnerability in PraisonAI's MCPToolIndex.search_tools() function allows for catastrophic backtracking, leading to a service outage. The issue was patched in version 4.5.90. This vulnerability has a CVSS score of 6.5 and a severity of MEDIUM. The CVE record was published on 2026-04-03T23:17:06.330Z and was last modified on 2026-07-24T22:10:00.140Z.
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-03T23:17:06.170Z and has not been modified since then. This critical vulnerability affects PraisonAI versions prior to 1.5.90, allowing arbitrary OS command execution on the host. The vulnerability is caused by a bypass of the three-layer sandbox in the execute_code() function, which can be achieved [truncated]
CVE-2026-34936 is a vulnerability in PraisonAI, a multi-agent teams system, that allows requests to any host reachable from the server. This issue arises from the passthrough() and apassthrough() functions in praisonai, which accept a caller-controlled api_base parameter. This parameter is concatenated with the endpoint and passed directly to httpx.Client.request() when the litellm primary path raises an [truncated]
CVE-2026-34935 is a critical vulnerability in PraisonAI, a multi-agent teams system, that allows arbitrary OS command execution. The vulnerability exists in versions 4.5.15 to before 4.5.69, where the --mcp CLI argument is passed directly to shlex.split() and forwarded to anyio.open_process() without validation, allowlist check, or sanitization. This issue enables attackers to execute OS commands as the p [truncated]
CVE-2026-34934 is a critical vulnerability in PraisonAI, a multi-agent teams system, with a CVSS score of 9.8. The vulnerability exists in the get_all_user_threads function, which constructs raw SQL queries using f-strings with unescaped thread IDs fetched from the database. An attacker can store a malicious thread ID via update_thread, and when the application loads the thread list, the injected payload [truncated]
