PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, MentionsParser._process_file_mention accepts file-mention values and falls back from workspace-relative resolution to Path(file_path) without traversal, symlink, or workspace-boundary validation. Prompt input from users, bots, or workflows can therefore read arbitrary files accessible to the process, including credentials, keys, environment files, source code, and system configuration. This issue is fixed in praisonaiagents 1.6.59.
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, SpiderTools._validate_url calls _host_is_blocked, which checks literal host encodings but does not resolve DNS names before scrape_page, crawl, extract_links, extract_text, or URL-mention fetches connect. An attacker-controlled hostname resolving to a loopback, private, link-local, or cloud-metadata address therefore bypasses the SSRF policy without a rebinding race and can expose internal responses to the agent. This issue is fixed in praisonaiagents 1.6.58.
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, execute_code sandbox mode permits runtime assembly of blocklisted dunder names and allows str.format or str.format_map to resolve dotted fields through C-level attribute access that bypasses _safe_getattr. This exposes class, qualified-name, base-class, globals, and object-dictionary attributes to prompt-influenced code when approval is automatically granted, producing a high-impact read primitive without establishing a complete in-process execution chain. This issue is fixed in praisonaiagents 1.6.59.
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, ToolsMCPServer.run_sse and launch_tools_mcp_server bind to 0.0.0.0 and create /sse and /messages/ routes without invoking the available SecurityConfig authentication, origin-validation, or DNS-rebinding controls. Any reachable client can list and invoke registered tools, and a browser can target a local instance through DNS rebinding, with impact determined by the registered file, shell, and code-execution tools. This vulnerability is fixed in praisonaiagents 1.6.59.
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai-agents/praisonaiagents/tools/email_tools.py interpolates LLM-controlled from_addr, subject, and query values directly into quoted IMAP SEARCH criteria. Embedded quote, backslash, newline, or null characters can escape the intended criterion and alter IMAP operations when search_emails, reply_email, or archive_email is exposed to an agent with configured email credentials, allowing mailbox data access, modification, deletion, or connection disruption. This issue is fixed in praisonaiagents 1.6.59.
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the SSE server in src/praisonai-agents/praisonaiagents/server/server.py does not consult ServerConfig.auth_token before handling /publish, /events, or /info requests. A network client that can reach the server can broadcast arbitrary events to connected clients and obtain server configuration and client-count information. This issue is fixed in praisonaiagents 1.6.58.
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, SpiderTools.scrape_page validates only the initial URL and lets requests.Session.get follow redirects automatically, so a public-looking URL can redirect to a loopback, private, link-local, or metadata address without revalidation. The redirected response body is returned through scrape_page and its extract_links, crawl, and extract_text callers, allowing disclosure from otherwise blocked services. This issue is fixed in praisonaiagents 1.6.59.
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.59 and praisonaiagents 1.6.59, the unauthenticated POST /api/v1/runs Jobs API accepts attacker-controlled agent_yaml, and the approve field can mark execute_command as YAML-approved before @require_approval checks critical tools. This chain allows a remote caller to cause a configured language model agent to invoke arbitrary operating-system commands without credentials or operator interaction. This vulnerability is fixed in praisonai 4.6.59 and praisonaiagents 1.6.59 as fixed versions.
CVE-2026-55536 is a critical improper access control vulnerability in MervinPraison's PraisonAI multi-agent teams system. Before version 4.6.58, the Browser Server's _handle_connection() function incorrectly validates Chrome extension origins using an unanchored regular expression, allowing extra trailing characters to bypass checks. This flaw permits unauthorized start_session commands and browser automation. The issue is fixed in PraisonAI version 4.6.58.
CVE-2026-55532 is an origin validation vulnerability in MervinPraison PraisonAI prior to version 4.6.58. The issue arises because the HTTP stream origin validation uses a startswith check, allowing attacker-controlled origins like localhost.attacker.com to bypass the localhost allowlist. This enables a webpage to send text/plain requests without preflight and invoke certain API calls without an API key, including file writes that can persist agent instructions. The vulnerability is fixed in version 4.6.58.
PraisonAI versions prior to 4.6.58 have an improper authentication vulnerability where the create_auth_middleware() function allows unauthenticated requests if the API key or JWT secret is missing. This enables an externally accessible Recipe server to accept unauthenticated POST requests to /v1/recipes/run despite authentication being enabled. The issue is resolved in version 4.6.58.
PraisonAI versions prior to 4.6.58 have a missing authentication vulnerability in the Jobs API create_app function. The API endpoint /api/v1/runs is accessible without authentication, allowing any caller to submit jobs, read results, cancel runs, or delete jobs using operator credentials. This issue is fixed in version 4.6.58 by adding middleware that enforces API key authorization.
CVE-2026-55527 is a path traversal vulnerability in MervinPraison PraisonAI affecting versions prior to 1.6.58. The issue arises because the FileMemory constructor joins an unsanitized user_id into a file path, allowing an attacker to escape the intended directory and write JSON data to arbitrary writable locations. This vulnerability is fixed in version 1.6.58.
CVE-2026-55541 is a high-severity vulnerability in MervinPraison's PraisonAI multi-agent teams system. Before version 4.6.58, the system's serve agents and unified parse API endpoints lack proper credential checks, allowing unauthenticated access to POST /agents and POST /api/v1/agents/{id}/invoke. This missing authorization issue is addressed in version 4.6.58.
CVE-2026-55535 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in MervinPraison's PraisonAI multi-agent teams system. Prior to version 4.6.58, the Jobs API's validate_webhook_url() function fails open on socket.gaierror and does not bind the validated address to the subsequent request. This allows an attacker to supply a webhook_url that later resolves to internal addresses such as 127.0.0.1 or 169.254.169.254. The issue is fixed in version 4.6.58.
CVE-2026-55537 is a high-severity TOCTOU race condition vulnerability in MervinPraison PraisonAI prior to version 4.6.58. The issue arises because JobSubmitRequest.validate_webhook_url() improperly accepts webhook URLs when DNS resolution raises a socket.gaierror exception, which it silently passes. Later, JobExecutor._send_webhook() performs a fresh DNS lookup, allowing an attacker to redirect requests to internal services by changing DNS responses between the two checks. This vulnerability is fixed in PraisonAI version 4.6.58.
CVE-2026-55538 is a vulnerability in MervinPraison's PraisonAI multi-agent system. Versions prior to 4.6.58 do not properly authenticate POST requests to /agents and /agents/{agent_name}, allowing requests with missing or incorrect bearer tokens and X-API-Key values to reach agent execution. This missing authentication for critical functions can lead to unauthorized access and potential impact on confidentiality, integrity, and availability. The issue is fixed in version 4.6.58.
CVE-2026-55540 is a path traversal vulnerability in MervinPraison PraisonAI prior to version 4.6.58. The issue arises because the function is_path_within_directory() uses os.path.abspath() instead of os.path.realpath() to enforce workspace boundaries. This allows a symbolic link inside the workspace to point outside the workspace and bypass the directory restriction, enabling unauthorized access to files outside the intended directory. The vulnerability is fixed in version 4.6.58.
CVE-2026-55530 is a missing authorization vulnerability in MervinPraison's PraisonAI multi-agent teams system. Before version 1.6.58, the ast_grep_rewrite tool did not enforce the required approval decorator, allowing an agent-controlled call with dry_run=False to perform broad file rewrites without proper authorization. This issue is fixed in version 1.6.58.
PraisonAI versions from 4.6.34 up to but not including 4.6.58 have a missing authentication vulnerability in the _create_agents_app() function. Specifically, the server accepts an --api-key parameter, but does not authenticate POST requests to /agents or /agents/{agent_name}, allowing network callers to invoke configured agents without credentials. This issue is fixed in version 4.6.58.