CVE-2026-57124: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in MervinPraison PraisonAI
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands bind to 0.0.0.0 by default, a reachable unauthenticated client can execute commands as the UI service account even when the MCP handshake later fails. This vulnerability is fixed in 4.6.59.
AI Analysis
Technical Summary
PraisonAI is a multi-agent teams system. Versions before 4.6.59 have a security flaw where the default UI host applications expose the POST /api/mcp/connect endpoint without requiring authentication. This endpoint accepts caller-controlled 'command' and 'args' parameters, which are passed to StdioMCPClient to start local processes. Since the UI binds to 0.0.0.0 by default, any unauthenticated client reachable on the network can exploit this to execute arbitrary OS commands as the UI service account, even if the MCP handshake fails later. The vulnerability is addressed in version 4.6.59.
Potential Impact
An unauthenticated remote attacker can execute arbitrary OS commands on the host running PraisonAI UI service with the privileges of the UI service account. This can lead to full system compromise, data loss, or service disruption. The vulnerability has a CVSS 3.1 score of 9.8 (critical), indicating high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Upgrade PraisonAI to version 4.6.59 or later, where this vulnerability is fixed. Prior to upgrading, restrict network access to the UI host applications to trusted clients only. Since the vulnerability arises from unauthenticated access to the POST /api/mcp/connect endpoint, enforcing authentication or network-level controls can mitigate exploitation risk. Patch status is confirmed fixed in 4.6.59.
CVE-2026-57124: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in MervinPraison PraisonAI
Description
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands bind to 0.0.0.0 by default, a reachable unauthenticated client can execute commands as the UI service account even when the MCP handshake later fails. This vulnerability is fixed in 4.6.59.
CVSS v3.1
Score 9.8critical
Affected software
MervinPraison
PraisonAI
pkg:github/mervinpraison/PraisonAIRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
PraisonAI is a multi-agent teams system. Versions before 4.6.59 have a security flaw where the default UI host applications expose the POST /api/mcp/connect endpoint without requiring authentication. This endpoint accepts caller-controlled 'command' and 'args' parameters, which are passed to StdioMCPClient to start local processes. Since the UI binds to 0.0.0.0 by default, any unauthenticated client reachable on the network can exploit this to execute arbitrary OS commands as the UI service account, even if the MCP handshake fails later. The vulnerability is addressed in version 4.6.59.
Potential Impact
An unauthenticated remote attacker can execute arbitrary OS commands on the host running PraisonAI UI service with the privileges of the UI service account. This can lead to full system compromise, data loss, or service disruption. The vulnerability has a CVSS 3.1 score of 9.8 (critical), indicating high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Upgrade PraisonAI to version 4.6.59 or later, where this vulnerability is fixed. Prior to upgrading, restrict network access to the UI host applications to trusted clients only. Since the vulnerability arises from unauthenticated access to the POST /api/mcp/connect endpoint, enforcing authentication or network-level controls can mitigate exploitation risk. Patch status is confirmed fixed in 4.6.59.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-24T00:33:17.707Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa80fff55bf5e2cf53beb1c
Added to database: 09/14/2026, 15:17:19 UTC
Last enriched: 09/14/2026, 15:31:46 UTC
Last updated: 09/15/2026, 03:32:58 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.