Threats tagged 'ghsa-6rmh-7xcm-cpxj'

PraisonAI ships a legacy Flask API server with authentication disabled by default, allowing any unauthenticated caller who can reach the server to access sensitive endpoints such as /agents and /chat. This enables triggering configured workflows without providing any authentication token. The vulnerable server binds to 0.0.0.0:8080 by default, exposing it to network access. Although newer commands provide safer defaults, the legacy server and generated sample deployment remain insecure. This issue affects versions from 2.5.6 up to but not including 4.6.34. A fix is available in version 4.6.34.