PraisonAI is a multi-agent teams system. From version 0.1.4 to before version 0.1.5 in praisonai-platform, a workspace member can permanently delete any resource — projects, agents, issues, labels, issue dependencies, and issue-label attachments — created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role check. A single malicious or compromised member account can wipe an entire workspace's content irreversibly. This issue has been patched in version 0.1.5.
CVE-2026-57117 is an OS command injection vulnerability in MervinPraison PraisonAI versions 4.6.10 up to but not including 4.6.59. The vulnerability arises because file operation commands are constructed using raw path arguments without proper neutralization, allowing an attacker to inject arbitrary shell commands. This affects local subprocess execution and Docker container execution environments. The issue has been patched in version 4.6.59.
PraisonAI versions from 4.2.1 up to but not including 4.6.59 have an unauthenticated AgentOS FastAPI deployment surface. This allows unauthorized actors to invoke agent.chat endpoints without authentication, potentially exposing sensitive information and enabling unauthorized agent operations. The issue has been patched in version 4.6.59.
CVE-2026-57114 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in MervinPraison PraisonAI versions 4.5.126 up to but not including 4.6.59. The Async Jobs API validates webhook URLs during job request parsing and again when constructing the internal Job object, blocking loopback/private targets at validation time. However, the actual webhook delivery does not re-validate the hostname, allowing an attacker to exploit DNS resolution changes to bypass SSRF protections. This vulnerability has been fixed in version 4.6.59.
PraisonAI is a multi-agent teams system. From version 2.6.0 to before version 4.6.59, PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/template@v1.0.0. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into ~/.praison/cache/templates/github/<owner>/<repo>/<template>/<ref> without normalizing each segment or checking that the final path remains inside the template cache root. A crafted ref such as ../../../../../../outside-delete-target therefore escapes the cache directory. The first load can write .cache_meta.json outside the cache. If the normal cache hierarchy for the same owner/repo/template has already been created, the same path reaches shutil.rmtree(cache_path) and removes an attacker-selected outside directory before replacing it with cache metadata. This issue has been patched in version 4.6.59.
A vulnerability in pghoard, a PostgreSQL backup daemon, prior to version 2.7.1 causes sensitive database connection information, including username and password, to be logged at the debug level when using .pgpass. This issue has been fixed in version 2.7.1.
This is a medium-severity phishing campaign observed in late 2026 targeting organizations during year-end and fiscal close periods. Attackers exploit increased legitimate administrative communications in finance, HR, and IT by impersonating compensation adjustments, Q4 financial documents, access reviews, invoice follow-ups, and benefits statements. The campaign uses themes from SharePoint, Docusign, and Microsoft 365 to deliver credential harvesting pages disguised as document-sharing portals. It affects multiple sectors including aviation, telecommunications, manufacturing, real estate, technology, and financial services, with a concentration in the Middle East. The phishing lures are generic and require minimal customization, making them effective during busy periods when employees expect increased document requests.
This analysis covers advanced Android threats that operate beyond the standard application sandbox, leveraging new OS-level telemetry features. Android's Delegated Scope allows enterprises to grant security apps access to logs on managed devices without full MDM control. The Intrusion Logging feature extends forensic visibility to BYOD users with Advanced Protection on Android 16 or later. This capability enables collection and sharing of encrypted security, DNS, and connection logs for threat analysis. The analysis reveals the full RatHat attack chain, including Wireless Debugging self-pairing, ADB shell command execution, daemon staging, and command-and-control communications, providing actionable indicators of compromise.
StealC malware has resurfaced as Stadia, a remote access trojan (RAT) that incorporates StealC's original code. Stadia extends capabilities beyond simple data theft to include hidden desktop control, live command shell, file management, process management, and in-memory loading. It communicates via plain HTTP to hardcoded IPs using RC4 encryption with Base64 encoding and persists through hidden scheduled tasks in randomized directories mimicking legitimate updaters. The operator targets former StealC customers with subscription offers. No official patches or fixes are available, and no known exploits in the wild have been reported.
In September 2026, an SEO poisoning campaign distributed Armorsteal malware via fake websites impersonating Chocolatey and Microsoft Activation Scripts tools. The malware is Python-based, protected by Pyarmor, and includes modules for remote access, surveillance, and information stealing. It captures keystrokes, clipboard data, cryptocurrency wallets, browser data, Discord tokens, passwords, and SSH keys. The campaign uses anti-analysis techniques such as cloud provider detection and code obfuscation, with frequent infrastructure changes observed. No patch or remediation is indicated, and no known exploits in the wild are reported.
CVE-2026-56840 is a high-severity cross-site scripting (XSS) vulnerability in MervinPraison's PraisonAI multi-agent teams system. Versions from 4.5.2 up to but not including 4.6.59 are affected. The vulnerability occurs because the HTTPApproval component renders attacker-controlled input directly into the approval dashboard HTML without proper neutralization. This allows an attacker to inject JavaScript that executes in the context of the dashboard, potentially approving malicious tool requests automatically. The issue has been patched in version 4.6.59.
CVE-2026-56838 is an OS command injection vulnerability in MervinPraison's PraisonAI affecting versions from 4.5.87 up to but not including 4.6.59. The issue arises because the streaming execution path recipe.run_stream() bypasses the dangerous tool policy check that is enforced in the normal recipe.run() path. This allows execution of commands that should be denied unless explicitly allowed, potentially leading to high impact on confidentiality, integrity, and availability. The vulnerability has been patched in version 4.6.59.
PraisonAI is a multi-agent teams system. From version 4.6.56 to before version 4.6.59, PraisonAI's LinearBot starts a public webhook listener on 0.0.0.0 and treats LINEAR_WEBHOOK_SECRET as optional. When the secret is absent, startup only logs a warning and _handle_webhook() skips Linear-Signature verification entirely. An unauthenticated network caller who can reach the webhook endpoint can submit a forged Linear-Event: AgentSession request. The forged request is parsed, scheduled for background processing, dispatched to _handle_agent_session(), and passed into BotSessionManager.chat(). The bot then attempts to post the agent response back to Linear under the configured bot token. The PoV is offline and deterministic. It does not contact Linear. It calls the webhook handler directly, monkey-patches the outbound Linear comment path, and proves both sides of the boundary. This issue has been patched in version 4.6.59.
CVE-2026-56836 is an improper authentication vulnerability in MervinPraison PraisonAI affecting versions from 4.5.112 up to but not including 4.6.59. The issue arises because the Recipe HTTP server can be started on a non-localhost interface without authentication, allowing unauthenticated access to the recipe API and potentially the /admin/reload endpoint. This vulnerability has been patched in version 4.6.59.
PraisonAI versions from 3.11.0 up to but not including 4.6.59 contain a missing authorization vulnerability in its Slack bot. The bot enforces user and channel restrictions in the normal Slack message event handler but fails to do so in the Slack app_mention event handler. This allows any Slack user who can mention the bot in a channel with the app installed to trigger configured agents despite restrictions, potentially leading to unauthorized actions. The issue is fixed in version 4.6.59.
PraisonAI versions from 3.8.1 up to but not including 4.6.59 contain a path traversal vulnerability in the Dynamic Context Discovery feature. This flaw allows unauthorized reading of arbitrary files on the host filesystem by manipulating artifact tool arguments. The vulnerability arises because the artifact tools do not verify that the supplied paths are within the configured artifact base directory or created by the configured store. This can expose sensitive files such as .env files, cloud credentials, SSH keys, and source code. The issue is fixed in version 4.6.59.
PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The module also exports agent-callable tool factories. Those tools accept run_id and agent_id arguments from the tool caller. The underlying stores join those values into filesystem paths without rejecting absolute paths or .. traversal. Because run_id can be an absolute path and agent_id can contain traversal, a lower-trust prompt/user that can call these tools can read .jsonl and .log files outside the configured Dynamic Context base directory. This issue has been patched in version 4.6.59.
PraisonAI versions from 4.5.2 up to but not including 4.6.59 contain a vulnerability in the Discord approval backend where any user able to post in the configured approval channel can approve a pending high-risk tool call by sending a message classified as approval (e.g., 'yes'). This occurs because the system does not verify that the approval message is a direct reply or otherwise bound to the approval request, allowing unthreaded channel cross-talk. The Slack and Telegram approval backends also lack explicit approver allowlist parameters, but the primary issue is with Discord. This vulnerability has been patched in version 4.6.59.
AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py hardcodes Flask debug mode while binding to all interfaces. Attackers who reach the server port and obtain the derivable Werkzeug debugger PIN can execute Python code and operating system commands with llm_server privileges.
Aider-AI's aider software up to version 0.86.2 contains an OS command injection vulnerability. This flaw allows attackers to execute arbitrary shell commands by committing a malicious .aider.conf.yml configuration file that is auto-loaded without user confirmation. The vulnerability arises because certain configuration values (notifications-command or editor) are executed via subprocess with shell=True, enabling command execution with the victim's privileges after model replies or editor use.