PraisonAI

PraisonAI is an open source project that runs AI agents from a prompt or a visual flow. See the repo: MervinPraison/PraisonAI t.co

Four attributes left out of PraisonAI's subprocess blocklist Four attributes left out of PraisonAI's subprocess blocklist Python sandboxes built from an attribute blocklist have a characteristic failure: the list is a description of what the author remembered, and the interpreter offers more than that. CVE-2026-39888 in PraisonAI is a precise account of four names that were missed. The record The CVE entry describes PraisonAI as a multi-agent teams system. Before version 1.5.115, execute_code() in praisonaiagents.tools.python_tools defaults to sandbox_mode="sandbox", which runs user code in a subprocess wrapped with a restricted __builtins__ dictionary and an AST-based blocklist. The problem is the blocklist inside the subprocess wrapper. The blocked_attrs list in python_tools.py contains only 11 attribute names, while the direct-execution path blocks more than 30. Six of those were named in the project's own advisory. The CVE record narrows to the four that matter for escape: __traceback__, tb_frame, f_back and f_builtins, all absent from the subprocess list. The CVSS 3.1 score is 9.9 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Scope is changed, because the escape leaves the intended sandbox boundary. The chain Python exceptions carry their own object graph. Raising and catching an exception in Python produces an object with a __traceback__ attribute pointing at a traceback object. That object has a tb_frame pointing at the frame in which the exception was raised. A frame has f_back pointing at the calling frame. A frame also has f_builtins, the builtins dictionary that frame resolves globals against. Each of those is a legitimate introspection feature. Together they are a path from a caught exception back to the interpreter's real builtins dictionary, the one the wrapper tried to replace with a restricted copy. Once a reference to the real builtins dictionary exists inside user code, the restriction is over. The advisory describes retrieving exec from that dictionary and calling it through a non-blocked variable name. Name-based filtering fails against that indirection, because the blocklist matches attribute names and the escape reaches a callable by indexing a dictionary with a string. Why a shorter list survived Two execution paths existed: direct execution and subprocess execution. The direct path had a thorough blocklist. The subprocess path had a shorter one, apparently because the outer wrapper was assumed to carry the security weight: the subprocess was thought to be the isolation boundary, and the inner list only needed to stop casual misuse. The premise failed in one specific way. A subprocess provides process-level isolation, not a restricted Python environment. It has its own full interpreter, its own builtins, and the same introspection features. Wrapping it with a restricted __builtins__ reproduces the appearance of a sandbox on top of a real interpreter, and the surface between them is the exception object. Implications Agent platforms execute model-generated code by design. The security question is not whether the code is trusted, it is whether a successful prompt injection that produces code can reach the host. In this case, the escape yields the environment the subprocess runs in, and the CVE record explicitly frames the outcome as exfiltrating all environment secrets along with arbitrary code execution. For deployments, that means the environment variables of the agent process are part of the exposure, and they typically contain model API keys, database passwords and cloud credentials. Remediation - Upgrade to 1.5.115 or later. Confirm the installed distribution package rather than the project version in a lockfile, since the vulnerable code lives in the tool module. - Do not rely on attribute blocklists as a boundary. The compensating control is process isolation with a real container: no host mounts, no shared network namespace with the control plane, an unprivileged user, a read-only root filesystem, and no credentials in the environment. - Move secrets out of the environment. Even with a correct sandbox, model-generated code that runs near credentials is a risk. Fetching them per call from a broker with a short-lived token changes the value of a successful escape. - Monitor what the agent runtime spawns. A tool that is supposed to execute arithmetic producing a network connection, a file write outside its workspace, or a child process is a finding. Detection notes Process and filesystem telemetry from the agent's container is more useful than log inspection, because the attack produces ordinary Python behaviour. A read of /proc/self/environ, a connection to a metadata endpoint, or a write to a directory the tool has no reason to touch are all visible at that layer. Review the tracebacks your platform stores. Exception data captured for observability often contains frame references and local variables. A system that stores full tracebacks for every agent error is keeping a copy of whatever the model-generated code touched, which is both a forensic asset and a data handling problem. The lesson that generalises When the same policy is implemented twice, the weaker copy decides the security property. A sandbox made of names is a sandbox that knows only the names someone listed, and Python has spent decades providing more ways to walk a frame than any blocklist will enumerate. References - CVE.org record for CVE-2026-39888: cve.org - NVD entry for CVE-2026-39888: nvd.nist.gov - GHSA-2xv2-w8cq-5gxw, PraisonAI CodeAgent advisory: github.com/MervinPraison/PraisonAI/security/advis…

Won an NVIDIA DGX Spark Founders Edition at Startup Day in Berlin! 🎉💚 Thanks @NVIDIA, Jessica Driscoll & Skye Hart! What should I build with PraisonAI first? 💻 MervinPraison/PraisonAI ▶️ youtube.com #DGXSpark #NVIDIAGTC t.co

PraisonAI Turns a Task Into a Working AI Team PraisonAI is an open source project that runs AI agents from a prompt or a visual flow. See the repo: MervinPraison/PraisonAI

Source, GHSA-4pcv-mg8v-vrgf (advisory June 18, 2026; CVE assigned Oct 12): github.com/MervinPraison/PraisonAI/security/advis… The CVE puts this fix at praisonaiagents 1.6.62; the GHSA lists 1.6.61. A separate SSRF, CVE-2026-61429, is fixed in 1.6.78, hence 1.6.78+.

Botnet hides its command server in a GitHub poem Black Lotus Labs reports PoeLLM's poetry-based command channel and compromised-server mining. JFrog reports an LMCache remote-code path under routable multiprocess configurations. A June 25 PraisonAI advisory is a background patch reminder. Zenity's October 7 article describes a replica test and illustrative agent failure scenarios. This episode covers source caveats, affected conditions and practical defender actions. 0:00 A botnet follows a GitHub poem 0:56 PoeLLM targets and the hidden command channel 2:34 Poem keywords become a command-server address 4:36 Reported victim totals and defender indicators 6:15 LMCache: critical only under the exposed configuration 7:51 Untrusted network data reaches pickle before the handler 8:56 Affected releases and transport containment 10:13 June 25 patch reminder: deploy code injection 12:19 An inbox-triggered replica exports customer data 13:35 Illustrative failure patterns reach tools and connectors 15:24 Reduce exposure, contain transport and constrain agent actions Sources Poem hides a botnet's command server: lumen.com LMCache remote-code flaw: no fix reported as of October 7: research.jfrog.com Background patch reminder: PraisonAI deploy injection: github.com/MervinPraison/PraisonAI/security/advis… Zenity reports data theft in a Copilot Studio replica test: zenity.io CVEs mentioned: CVE-2026-10520, CVE-2026-42271, CVE-2026-105192, CVE-2026-62176. About this video: the host is an animated character and the narration is AI-generated speech. Scripts are written from the primary sources above and fact-checked before publication. Avatar animation: Talking Head(?) Anime from a Single Image 3 by Pramook Khungurn (CC BY 4.0). #AI #ArtificialIntelligence #AISecurity #Cybersecurity #PoeLLM #LMCache #PromptInjection

CVE-2026-61427: CVE-2026-61427: Authentication Bypass and Unvalidated Tool Execution in PraisonAI MCP HTTP-Stream Server CVE-2026-61427: Authentication Bypass and Unvalidated Tool Execution in PraisonAI MCP HTTP-Stream Server > Vulnerability ID: CVE-2026-61427 > CVSS Score: 7.3 > Published: 2026-10-08 CVE-2026-61427 is a critical authentication bypass and improper input validation vulnerability within the Model Context Protocol (MCP) HTTP-stream server of PraisonAI. In versions prior to 4.6.78, the server lacks authentication by default and forwards client messages directly to Python tool handlers without input validation. When bound to non-localhost interfaces, this permits unauthenticated remote attackers to perform unauthorized administrative operations and execute tools. TL;DR Unauthenticated remote attackers can query and invoke administrative tools on PraisonAI MCP servers due to missing default authentication and input validation. --- ⚠️ Exploit Status: POC Technical Details - CWE ID: CWE-306 (Missing Authentication), CWE-20 (Improper Input Validation) - Attack Vector: Network - CVSS v3.1: 7.3 (High) - EPSS Score: 0.00389 (~0.39% probability) - Exploit Status: Proof of Concept (PoC) - CISA KEV Status: Not Listed Affected Systems - PraisonAI MCP Server Component - PraisonAI: < 4.6.78 (Fixed in: 4.6.78) Code Analysis Commit: 393de39 Fix: Require api_key when MCP HTTP-stream binds to a non-localhost address Mitigation Strategies - Upgrade PraisonAI to version 4.6.78 or above. - Explicitly configure an API key when launching the MCP HTTP-stream server. - Restrict bind interfaces to localhost (127.0.0.1) unless external connectivity is required. - Implement firewall rules to drop traffic on port 8000 from untrusted IP ranges. Remediation Steps: 1. Execute pip install --upgrade praisonai to apply the fix. 2. Verify the version using pip show praisonai. 3. Modify execution scripts to generate and pass a strong API key via the --api-key argument. 4. Restrict host bindings by using --host 127.0.0.1. References - GHSA-hc5v-gxvj-58wh - PraisonAI Fix Commit - VulnCheck Security Advisory - NVD CVE-2026-61427 Details --- Read the full report for CVE-2026-61427 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-61431: CVE-2026-61431: Arbitrary Local File Read and Path Traversal in PraisonAI ContextGatherer CVE-2026-61431: Arbitrary Local File Read and Path Traversal in PraisonAI ContextGatherer > Vulnerability ID: CVE-2026-61431 > CVSS Score: 6.8 > Published: 2026-10-08 PraisonAI is vulnerable to an arbitrary local file read vulnerability prior to version 4.6.78. The flaw is in the ContextGatherer component, where validation checks are executed only after files are parsed and appended to the context bundle, bypassing security constraints. TL;DR A check-after-use path traversal vulnerability in PraisonAI's ContextGatherer allows unauthorized reading of sensitive local host files. --- ⚠️ Exploit Status: POC Technical Details - CWE ID: CWE-22 / CWE-200 - Attack Vector: Local - CVSS Score: 6.8 - Exploit Status: Proof-of-Concept - CISA KEV Status: No - Impact: Information Disclosure Affected Systems - PraisonAI - PraisonAIAgents - praisonai: < 4.6.78 (Fixed in: 4.6.78) - praisonaiagents: < 4.6.78 (Fixed in: 4.6.78) Code Analysis Commit: 393de39 Fix path safety and validate include paths using _resolve_include_path before reading files Commit: 1620b49 Fix Formula/Orphan Cleanup and additional path safety configurations Exploit Details - GitHub Security Advisory: GHSA publication highlighting local path traversal through malicious context configurations. Mitigation Strategies - Upgrade PraisonAI to version 4.6.78 or later to resolve the logic bug. - Manually audit .praisoncontext and .praisoninclude files within codebase workspaces before execution. - Containerize PraisonAI execution within restricted, non-root system environments. Remediation Steps: 1. Execute 'pip install --upgrade praisonai praisonaiagents' to pull down the safe version. 2. Verify that the active version of PraisonAI is 4.6.78 or above. 3. Implement secure repository validation to filter untrusted user configurations in automated pipelines. References - GitHub Security Advisory GHSA-q7m5-3jmv-vm48 - Fix Commit 393de394087e3badc79acfec490323bcc99638bd - Fix Commit 1620b49f36945d8cc8ee5635b906c960df5097a0 - VulnCheck Advisory for PraisonAI Path Traversal - CVE-2026-61431 Record --- Read the full report for CVE-2026-61431 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-61439: CVE-2026-61439: Prompt Injection Defense Bypass in PraisonAI InjectionDefense Engine CVE-2026-61439: Prompt Injection Defense Bypass in PraisonAI InjectionDefense Engine > Vulnerability ID: CVE-2026-61439 > CVSS Score: 7.5 > Published: 2026-10-07 This report provides a comprehensive technical analysis of CVE-2026-61439 (GHSA-fj8f-m44g-c479), a prompt injection defense bypass vulnerability in the PraisonAI multi-agent framework. In versions prior to 4.6.78, the InjectionDefense scanner threshold defaulted to CRITICAL. This allowed single-vector prompt injections classified as HIGH severity (e.g., direct instruction overrides or financial manipulations) to pass through unblocked, enabling attackers to extract system prompts and execute unauthorized agent tools. TL;DR PraisonAI versions before 4.6.78 contain an insecure default configuration in the InjectionDefense component, allowing high-severity prompt injections to bypass active blocking controls. --- ⚠️ Exploit Status: POC Technical Details - CWE ID: CWE-1188 - Attack Vector: Network (AV:N) - CVSS v3.1 Score: 7.5 (High) - EPSS Score / Percentile: 0.00432 (0.43% probability) / 35.46th percentile - Impact: Confidentiality Breach / System Prompt Extraction - Exploit Status: Proof-of-Concept / Logical Bypass - CISA KEV Status: Not Listed Affected Systems - PraisonAI Framework - PraisonAI Agents Module - PraisonAI: < 4.6.78 (Fixed in: 4.6.78) Code Analysis Commit: 393de39 Fix default block threshold in prompt injection defense to HIGH severity diff --git a/src/praisonai/praisonai/security/injection.py b/src/praisonai/praisonai/security/injection.py index 9d7f9a79cf..ce7acca988 100644 --- a/src/praisonai/praisonai/security/injection.py +++ b/src/praisonai/praisonai/security/injection.py @@ -233,7 +233,7 @@ def scan_text(text: str, source: str = "external") -> ScanResult: level = ThreatLevel.CRITICAL # Trusted sources are never blocked regardless of level - blocked = (level >= ThreatLevel.CRITICAL) and not is_trusted + blocked = (level >= ThreatLevel.HIGH) and not is_trusted if triggered: logger.warning( @@ -270,14 +270,14 @@ class InjectionDefense: def __init__( self, extra_patterns: Optional[List[str]] = None, - block_threshold: ThreatLevel = ThreatLevel.CRITICAL, + block_threshold: ThreatLevel = ThreatLevel.HIGH, trusted_sources: Optional[List[str]] = None, ): """ Args: extra_patterns: Additional regex patterns to include in Check 1. block_threshold: Minimum threat level that causes blocking. - Default: CRITICAL (only block if 3+ checks fire). + Default: HIGH (block single high-severity detections). trusted_sources: Source names that bypass blocking. """ self._extra_patterns = extra_patterns or [] Mitigation Strategies - Upgrade to PraisonAI version 4.6.78 or newer to apply the secure-by-default behavior. - Manually configure the block_threshold parameter to ThreatLevel.HIGH when instantiating the InjectionDefense class. - Implement real-time monitoring and alerting for ThreatLevel.HIGH logs that bypass active blocking in legacy installations. Remediation Steps: 1. Identify all microservices and deployments utilizing PraisonAI or praisonaiagents. 2. Execute pip install --upgrade praisonai praisonaiagents to update the dependency to version 4.6.78 or higher. 3. If immediate upgrading is impossible, edit application initialization code to enforce block_threshold=ThreatLevel.HIGH. 4. Verify the configuration by executing a test query containing a single-vector prompt override and confirming it is blocked. References - GitHub Security Advisory GHSA-fj8f-m44g-c479 - VulnCheck Security Advisory - Fix Commit (Git Repository Diff) - NVD Vulnerability Detail - Official CVE.org Record --- Read the full report for CVE-2026-61439 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-61436: CVE-2026-61436: Missing Webhook Signature Verification in PraisonAI AgentMail Endpoint CVE-2026-61436: Missing Webhook Signature Verification in PraisonAI AgentMail Endpoint > Vulnerability ID: CVE-2026-61436 > CVSS Score: 8.6 > Published: 2026-10-07 A critical security flaw exists in PraisonAI before version 4.6.78 when operating in AgentMail webhook mode. The application processes incoming POST requests without checking for cryptographic signatures, allowing unauthenticated attackers to forge emails, spoof identities, and force AI agents to execute unauthorized operations. TL;DR Unauthenticated remote attackers can spoof email webhook payloads to PraisonAI endpoints, forcing AI agents to execute unauthorized workflows due to a lack of cryptographic signature verification. --- ⚠️ Exploit Status: POC Technical Details - CWE ID: CWE-287 - Attack Vector: Network (Unauthenticated) - CVSS v3.1 Score: 8.6 (High) - CVSS v4.0 Score: 8.8 (High) - EPSS Score: 0.00518 - EPSS Percentile: 42.17% - Exploit Status: Proof-of-Concept (PoC) - CISA KEV: Not Listed Affected Systems - PraisonAI deployments utilizing AgentMail configurations - praisonai: < 4.6.78 (Fixed in: 4.6.78) Code Analysis Commit: 393de39 Fix missing webhook signature verification on AgentMail webhook endpoints Mitigation Strategies - Upgrade the local PraisonAI dependency package to version 4.6.78 or above. - Define and enforce the AGENTMAIL_WEBHOOK_SECRET environment variable with a strong, randomly generated alphanumeric string. - Implement network-level access control lists (ACLs) to allow webhook traffic exclusively from legitimate service provider IP blocks. Remediation Steps: 1. Identify all deployment instances running PraisonAI with AgentMail webhook routes enabled. 2. Execute 'pip install --upgrade "praisonai>=4.6.78"' to fetch and install the updated build. 3. Generate a cryptographically secure 32-byte secret key. 4. Export the secret into the environment configurations as AGENTMAIL_WEBHOOK_SECRET. 5. Configure the corresponding webhook dispatcher with the exact secret to sign outgoing headers. References - GitHub Security Advisory (GHSA-7c92-x8vg-4258) - NVD Official CVE Record - Mitigation Commit - VulnCheck Advisory Portal --- Read the full report for CVE-2026-61436 on our website for more details including interactive diagrams and full exploit analysis.