PraisonAI versions prior to 4.6.78 contain a vulnerability in the JobWorkflowExecutor._exec_inline_python() function that allows remote code execution. The vulnerability arises because the sandbox intended to safely execute inline Python expressions is broken: the 'os' module is allowed to be imported, and dangerous functions like os.system() can be called. This enables an attacker to execute arbitrary OS commands with the privileges of the user running the workflow, particularly in multi-tenant or CI environments where untrusted YAML workflows may be executed.
CVE-2026-57144 is a high-severity vulnerability in MervinPraison's PraisonAI multi-agent teams system affecting versions from 4.5.110 up to but not including 4.6.61. The issue arises when the SandlockSandbox fallback mechanism activates on systems where the Landlock security module is unavailable. Instead of enforcing filesystem and network restrictions, the fallback SubprocessSandbox does not enforce these boundaries, allowing sandboxed code to access unauthorized files and open network connections despite restrictions. This flaw has been fixed in version 4.6.61.
PraisonAI is a multi-agent teams system. Prior to version 4.6.78, the `deploy/api.py` module generates Python server code by directly interpolating the `agents_file` parameter into an f-string that is then written to a file and executed via `subprocess.Popen()`. An attacker who controls the `agents_file` value (via CLI argument, configuration, or upstream API) can inject arbitrary Python code. Version 4.6.78 patches the issue.
CVE-2026-57112 is a high-severity vulnerability in MervinPraison's PraisonAI multi-agent system affecting versions from 0.6.0 up to but not including 1.6.59 and 3.10.0 up to but not including 4.6.59. The issue arises because the legacy SSE wrapper mounts SseServerTransport on /sse and /messages/ endpoints without enforcing Host, Origin, or authentication checks. This allows a malicious website to perform DNS rebinding attacks to enumerate and invoke registered tools with the server user's privileges. An initial fix was released in versions 1.6.59 and 4.6.59.
PraisonAI versions 3.9.26 through 4.6.57 and praisonaiagents versions 0.12.12 through 1.6.57 contain a code injection vulnerability in the workflow "include" feature. The vulnerability arises because the _execute_include() function imports and executes an included recipe's tools.py file without enforcing security gates or using a safe loader. This allows arbitrary Python code execution if an attacker can cause a workflow to include an untrusted local recipe. The issue is fixed in versions 4.6.58 and 1.6.58 respectively.
PraisonAI versions up to 4.6.77 contain an authentication bypass vulnerability in the Call API agent invocation endpoints when the PRAISONAI_CALL_AUTH setting is disabled. The vulnerability arises because the localhost-only restriction is enforced by checking the HTTP Host header, which is client-controlled, allowing a remote attacker to spoof this header and bypass authentication to list and invoke agents.
PraisonAI versions up to 4.6.77 contain a vulnerability where deployment configuration values are not safely encoded when generating Python source code for API servers. This allows attackers to inject arbitrary Python expressions via specific configuration parameters, leading to code execution when the server starts or processes requests.
PraisonAI versions up to 4.6.77 contain a critical SQL injection vulnerability in the PGVector and Cassandra knowledge-store create_collection() backends. The vulnerability arises because the dimension argument, which should be an integer, is not validated at runtime and is directly interpolated into the CREATE TABLE DDL statement. This allows an attacker controlling the dimension parameter to inject arbitrary SQL or CQL commands, potentially leading to data compromise or destruction.
PraisonAI versions up to 4.6.77 contain a vulnerability where custom command templates do not properly validate file path references. This allows attackers to perform path traversal or use absolute paths to read files outside the intended workspace, potentially exposing sensitive information. The vulnerability has a medium severity rating with a CVSS score of 5.5. The advisory is a duplicate and has been withdrawn in favor of another reference. No patch links are provided in this data.
PraisonAI versions up to 4.6.77 have a prompt injection defense misconfiguration where the block threshold is set to block only CRITICAL severity threats. This allows HIGH-level prompt injection attacks to bypass blocking and only be logged. Such attacks can include instruction overrides or financial manipulation, potentially enabling unauthorized extraction of system prompts and tool invocations. The vulnerability has a CVSS score of 7.5, indicating high severity.
PraisonAI versions up to 4.6.77 contain a path traversal vulnerability in the ContextGatherer component. This flaw allows attackers to supply absolute or parent directory traversal paths in .praisoncontext and .praisoninclude files, enabling reading of arbitrary files outside the intended workspace. The vulnerability has a medium severity rating with a CVSS score of 5.5.
PraisonAI versions up to 4.6.77 have a prompt injection defense vulnerability where the defense only blocks threats classified as CRITICAL, requiring three or more detector families to trigger simultaneously. This allows attackers to bypass the defense with single or double-vector prompt injections classified as HIGH threat level, which pass through unblocked.
PraisonAI (pip package praisonaiagents) before 1.6.78 contains an unsafe dynamic module loading vulnerability in AgentFlow._resolve_pydantic_class (src/praisonai-agents/praisonaiagents/workflows/workflows.py). When a workflow step uses a string output_pydantic reference, the framework locates and imports a sibling tools.py from the workflow file's directory via importlib exec_module without sandboxing, ignoring the PRAISONAI_ALLOW_*_TOOLS environment variables. An attacker who controls a workflow file and its sibling tools.py can execute arbitrary Python code with the workflow runner's privileges when the workflow is executed via WorkflowManager or after load_yaml.
PraisonAI before 1.5.115 contains a path traversal vulnerability in MultiAgentMonitor that fails to sanitize agent IDs when building file paths. Attackers can include traversal sequences like ../ in agent IDs to read, write, or overwrite arbitrary files, enabling sensitive disclosure, denial of service, or code execution.
PraisonAI before 1.5.115 contains an information disclosure vulnerability in the MultiAgentLedger component that allows attackers to access sensitive data by registering agents with duplicate IDs. Attackers can exploit the lack of agent ID uniqueness enforcement to share ledger instances and expose system prompts and conversation history between agents.
PraisonAI before 1.5.128 contains a cross-origin agent execution vulnerability in the AGUI endpoint that allows remote attackers to trigger arbitrary agent execution. The POST /agui endpoint lacks authentication and hardcodes Access-Control-Allow-Origin: * headers, combined with Starlette's Content-Type-agnostic JSON parsing, enabling attackers to bypass CORS preflight checks via simple requests and exfiltrate sensitive agent responses including tool execution results and environment data.
PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI modules hardcode approval_mode to auto, overriding administrator configuration from PRAISON_APPROVAL_MODE environment variable. Authenticated attackers can instruct the LLM agent to execute arbitrary shell commands via subprocess.run with shell=True, bypassing the manual approval gate and insufficient command sanitization blocklists.
PraisonAI versions prior to 4.6.37 contain a vulnerability in the _safe_extractall helper function used in recipe pull, publish, and unpack operations. The function validates archive member names to prevent path traversal but fails to validate symlink or hardlink targets (member.linkname). This allows a crafted archive with a symlink pointing outside the extraction directory, followed by a file traversing that symlink, to write arbitrary files outside the intended directory. This can lead to arbitrary file writes with attacker-controlled content on the victim system.
The praisonaiagents package contains a vulnerability in its tool execution mechanism where unresolved tool names are resolved against module globals and __main__, allowing invocation of undeclared callables. By default, the permission system does not restrict tool calls, enabling attackers who can influence tool-call names to execute unintended application functions. This issue affects praisonaiagents versions prior to 1.6.37 and PraisonAI versions prior to 4.6.37. A fix is available in versions 1.6.37 and 4.6.37.
PraisonAI MCP server versions prior to 4.6.34 contain a critical path traversal vulnerability in four default file-handling tools that accept unvalidated path inputs. This allows attackers to write arbitrary files outside the intended directory, including Python .pth files in the user site-packages directory, leading to arbitrary code execution in subsequent Python processes. The vulnerability can be exploited without operator misconfiguration and is reachable via local or LLM-connected contexts without user interaction beyond normal usage. A fix is available in version 4.6.34.