PraisonAI versions prior to 4.6.78 contain a vulnerability in the JobWorkflowExecutor._exec_inline_python() function that allows remote code execution. The vulnerability arises because the sandbox intended to safely execute inline Python expressions is broken: the 'os' module is allowed to be imported, and dangerous functions like os.system() can be called. This enables an attacker to execute arbitrary OS commands with the privileges of the user running the workflow, particularly in multi-tenant or CI environments where untrusted YAML workflows may be executed.
CVE-2026-57144 is a high-severity vulnerability in MervinPraison's PraisonAI multi-agent teams system affecting versions from 4.5.110 up to but not including 4.6.61. The issue arises when the SandlockSandbox fallback mechanism activates on systems where the Landlock security module is unavailable. Instead of enforcing filesystem and network restrictions, the fallback SubprocessSandbox does not enforce these boundaries, allowing sandboxed code to access unauthorized files and open network connections despite restrictions. This flaw has been fixed in version 4.6.61.
PraisonAI is a multi-agent teams system. Prior to version 4.6.78, the `deploy/api.py` module generates Python server code by directly interpolating the `agents_file` parameter into an f-string that is then written to a file and executed via `subprocess.Popen()`. An attacker who controls the `agents_file` value (via CLI argument, configuration, or upstream API) can inject arbitrary Python code. Version 4.6.78 patches the issue.
CVE-2026-57112 is a high-severity vulnerability in MervinPraison's PraisonAI multi-agent system affecting versions from 0.6.0 up to but not including 1.6.59 and 3.10.0 up to but not including 4.6.59. The issue arises because the legacy SSE wrapper mounts SseServerTransport on /sse and /messages/ endpoints without enforcing Host, Origin, or authentication checks. This allows a malicious website to perform DNS rebinding attacks to enumerate and invoke registered tools with the server user's privileges. An initial fix was released in versions 1.6.59 and 4.6.59.
PraisonAI versions 3.9.26 through 4.6.57 and praisonaiagents versions 0.12.12 through 1.6.57 contain a code injection vulnerability in the workflow "include" feature. The vulnerability arises because the _execute_include() function imports and executes an included recipe's tools.py file without enforcing security gates or using a safe loader. This allows arbitrary Python code execution if an attacker can cause a workflow to include an untrusted local recipe. The issue is fixed in versions 4.6.58 and 1.6.58 respectively.
PraisonAI versions up to 4.6.77 contain an authentication bypass vulnerability in the Call API agent invocation endpoints when the PRAISONAI_CALL_AUTH setting is disabled. The vulnerability arises because the localhost-only restriction is enforced by checking the HTTP Host header, which is client-controlled, allowing a remote attacker to spoof this header and bypass authentication to list and invoke agents.
PraisonAI versions up to 4.6.77 contain a vulnerability where deployment configuration values are not safely encoded when generating Python source code for API servers. This allows attackers to inject arbitrary Python expressions via specific configuration parameters, leading to code execution when the server starts or processes requests.
PraisonAI versions up to 4.6.77 contain a critical SQL injection vulnerability in the PGVector and Cassandra knowledge-store create_collection() backends. The vulnerability arises because the dimension argument, which should be an integer, is not validated at runtime and is directly interpolated into the CREATE TABLE DDL statement. This allows an attacker controlling the dimension parameter to inject arbitrary SQL or CQL commands, potentially leading to data compromise or destruction.
PraisonAI versions up to 4.6.77 contain a vulnerability where custom command templates do not properly validate file path references. This allows attackers to perform path traversal or use absolute paths to read files outside the intended workspace, potentially exposing sensitive information. The vulnerability has a medium severity rating with a CVSS score of 5.5. The advisory is a duplicate and has been withdrawn in favor of another reference. No patch links are provided in this data.
PraisonAI versions up to 4.6.77 have a prompt injection defense misconfiguration where the block threshold is set to block only CRITICAL severity threats. This allows HIGH-level prompt injection attacks to bypass blocking and only be logged. Such attacks can include instruction overrides or financial manipulation, potentially enabling unauthorized extraction of system prompts and tool invocations. The vulnerability has a CVSS score of 7.5, indicating high severity.
PraisonAI versions up to 4.6.77 contain a path traversal vulnerability in the ContextGatherer component. This flaw allows attackers to supply absolute or parent directory traversal paths in .praisoncontext and .praisoninclude files, enabling reading of arbitrary files outside the intended workspace. The vulnerability has a medium severity rating with a CVSS score of 5.5.
PraisonAI versions up to 4.6.77 have a prompt injection defense vulnerability where the defense only blocks threats classified as CRITICAL, requiring three or more detector families to trigger simultaneously. This allows attackers to bypass the defense with single or double-vector prompt injections classified as HIGH threat level, which pass through unblocked.
PraisonAI (pip package praisonaiagents) before 1.6.78 contains an unsafe dynamic module loading vulnerability in AgentFlow._resolve_pydantic_class (src/praisonai-agents/praisonaiagents/workflows/workflows.py). When a workflow step uses a string output_pydantic reference, the framework locates and imports a sibling tools.py from the workflow file's directory via importlib exec_module without sandboxing, ignoring the PRAISONAI_ALLOW_*_TOOLS environment variables. An attacker who controls a workflow file and its sibling tools.py can execute arbitrary Python code with the workflow runner's privileges when the workflow is executed via WorkflowManager or after load_yaml.
PraisonAI versions prior to 4.6.37 contain a vulnerability in the _safe_extractall helper function used in recipe pull, publish, and unpack operations. The function validates archive member names to prevent path traversal but fails to validate symlink or hardlink targets (member.linkname). This allows a crafted archive with a symlink pointing outside the extraction directory, followed by a file traversing that symlink, to write arbitrary files outside the intended directory. This can lead to arbitrary file writes with attacker-controlled content on the victim system.
The praisonaiagents package contains a vulnerability in its tool execution mechanism where unresolved tool names are resolved against module globals and __main__, allowing invocation of undeclared callables. By default, the permission system does not restrict tool calls, enabling attackers who can influence tool-call names to execute unintended application functions. This issue affects praisonaiagents versions prior to 1.6.37 and PraisonAI versions prior to 4.6.37. A fix is available in versions 1.6.37 and 4.6.37.
PraisonAI's knowledge-store backends for SQL and CQL databases interpolate unvalidated collection and name parameters directly into query strings, leading to potential SQL and CQL injection vulnerabilities. This affects the pgvector, Cassandra, and SingleStore vector backends. The issue arises because these backends do not validate or quote collection names before using them in dynamic SQL/CQL statements. A validation function exists elsewhere in the codebase but is not applied here. Versions from 2.4.1 up to but not including 4.6.34 are affected. A fix is available in version 4.6.34.
PraisonAI ships a legacy Flask API server with authentication disabled by default, allowing any unauthenticated caller who can reach the server to access sensitive endpoints such as /agents and /chat. This enables triggering configured workflows without providing any authentication token. The vulnerable server binds to 0.0.0.0:8080 by default, exposing it to network access. Although newer commands provide safer defaults, the legacy server and generated sample deployment remain insecure. This issue affects versions from 2.5.6 up to but not including 4.6.34. A fix is available in version 4.6.34.
PraisonAI is a multi-agent teams system. Prior to version 4.6.34, PraisonAI's MCP (Model Context Protocol) server (praisonai mcp serve) registers four file-handling tools by default — praisonai.rules.create, praisonai.rules.show, praisonai.rules.delete, and praisonai.workflow.show. Each accepts a path or filename string from MCP tools/call arguments and joins it onto ~/.praison/rules/ (or, for workflow.show, accepts an absolute path) with no containment check. The JSON-RPC dispatcher passes params["arguments"] blind to each handler via **kwargs without validating against the advertised input schema. By setting rule_name="../../<some-path>" an attacker walks out of the rules directory and writes any file the running user can write. Dropping a Python .pth file into the user site-packages directory escalates this primitive to arbitrary code execution in any subsequent Python process the user spawns — the next praisonai CLI invocation, an IDE script run, the user's python REPL, or any background Python service. This issue has been patched in version 4.6.34.
PraisonAI is a multi-agent teams system. Prior to praisonai version 4.6.9 and praisonaiagents version 1.6.9, the fix for CVE-2026-40315 added input validation to SQLiteConversationStore only. Nine sibling backends — MySQL, PostgreSQL, async SQLite/MySQL/PostgreSQL, Turso, SingleStore, Supabase, SurrealDB — pass table_prefix straight into f-string SQL. Same root cause, same code pattern, same exploitation.52 unvalidated injection points across the codebase.postgres.py additionally accepts an unvalidated schema parameter used directly in DDL. This issue has been patched in praisonai version 4.6.9 and praisonaiagents version 1.6.9.