praisonai@4.5.22

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Improper Authentication via the agent_invoke.py process when the environment variable PRAISONAI_CALL_AUTH is set to disabled. An attacker can gain unauthorized access to list and invoke registered agents by sending a crafted HTTP request with a spoofed Host header set to 127.0.0.1, thereby bypassing the intended localhost-only restriction. This is only exploitable if the configuration allows authentication to be disabled and the service is accessible over the network.

Upgrade PraisonAI to version 4.6.81 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Command Injection via insufficient validation in the JobWorkflowExecutor._exec_inline_python function. An attacker can execute arbitrary operating system commands by crafting malicious YAML workflow files that include import statements and system calls, bypassing intended sandbox restrictions.

Upgrade PraisonAI to version 4.6.81 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Improper Check for Dropped Privileges due to the lack of enforcement of security restrictions in the Subprocess Sandbox backend, including blocked_commands, blocked_paths, blocked_imports, allow_subprocess, and allow_file_write. An attacker can execute arbitrary subprocess commands, access sensitive files, and perform unauthorized operations by bypassing intended security policies.

Upgrade PraisonAI to version 4.6.81 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Improper Input Validation via the http-stream transport when the server is configured without an API key. An attacker can gain unauthorized access to enumerate available tools and invoke tool functions by sending unauthenticated requests. Additionally, arguments to tool calls are forwarded without validation against the expected input schema. This is only exploitable if the server is bound to a network-accessible address (e.g., --host 0.0.0.0).

Upgrade PraisonAI to version 4.6.81 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Arbitrary Code Injection via the deploy.api.host and agents_file configuration parameters when generating Python source code for API servers. An attacker can execute arbitrary Python code by supplying crafted values to these parameters, which are incorporated into the generated server and executed when the server starts or processes requests.

Upgrade PraisonAI to version 4.6.81 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Directory Traversal via the AICoder component due to missing path validation and command sanitization in LLM tool calls. An attacker can write files to arbitrary filesystem locations and execute arbitrary shell commands with root privileges by injecting malicious prompts through the chat interface.

Upgrade PraisonAI to version 4.6.81 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Missing Authorization in the PATCH routes for projects, issues, and agents, where insufficient authorization checks allow a workspace member to modify records created by owners or admins. An attacker can gain unauthorized access to modify or delete resources by exploiting the lack of proper role validation on these endpoints.

Upgrade PraisonAI to version 4.6.63 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Insecure Default Initialization of Resource due to a misconfiguration in the prompt injection defense threshold, which defaults to blocking only CRITICAL severity threats. An attacker can bypass intended security controls by submitting prompt injection attacks that trigger HIGH severity detections, resulting in unauthorized access to system prompts and invocation of restricted tools.

Upgrade PraisonAI to version 4.6.81 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to User Impersonation due to missing signature verification in the webhook process. An attacker can inject arbitrary messages and trigger replies to attacker-controlled addresses by sending crafted POST requests to the webhook endpoint, effectively bypassing sender allow/block lists.

Upgrade PraisonAI to version 4.6.81 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the webhook_url parameter in the /api/v1/runs endpoint. An attacker can access internal services by exploiting DNS rebinding, as the parameter is validated at request time but re-resolved at connection time, enabling unauthorized requests to internal resources.

Upgrade PraisonAI to version 4.6.81 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Command Injection in the find command handling process. An attacker can execute unauthorized commands, read or delete files, and bypass command restrictions by leveraging the -exec, -execdir, or -delete actions in crafted input.

Upgrade PraisonAI to version 4.6.81 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Missing Authorization via the DELETE dependency route, which accepts either endpoint of a dependency edge and validates permissions only against the caller-selected issue. An attacker can remove dependencies created by an owner or admin by targeting a related member-owned issue endpoint, thereby bypassing intended authorization controls.

Upgrade PraisonAI to version 4.6.63 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Arbitrary Code Injection via the agents_file parameter in deploy/api.py. An attacker can execute arbitrary Python code by injecting malicious input that is directly interpolated into an f-string and subsequently executed when the generated server code runs through subprocess.Popen().

Upgrade PraisonAI to version 4.6.81 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Directory Traversal via the agent.start process. An attacker can overwrite files outside the intended project directory by supplying a malicious .praisonai/config.toml file that sets the output_file path to an absolute or directory traversal value, causing the application to write output to arbitrary locations with the privileges of the user running the process.

Upgrade PraisonAI to version 4.6.65 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Protection Mechanism Failure due to insufficient enforcement in the prompt injection defense process. An attacker can cause unauthorized prompts to bypass intended security controls by crafting single or double-vector prompt injections that are classified below the highest threat level.

Upgrade PraisonAI to version 4.6.81 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Directory Traversal via the FastContextAgent.execute_tool process. An attacker can access and read files outside the intended workspace directory by supplying absolute paths or directory traversal sequences in tool arguments or model-generated function calls.

Upgrade PraisonAI to version 4.6.64 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Directory Traversal via the ContextGatherer process. An attacker can access arbitrary files outside the intended workspace by supplying absolute paths or parent directory traversal sequences in .praisoncontext or .praisoninclude files.

Upgrade PraisonAI to version 4.6.81 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Directory Traversal via the processing of custom command templates that fail to validate file path references. An attacker can access files outside the intended workspace by including path traversal sequences or absolute paths in project command files.

Upgrade PraisonAI to version 4.6.81 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to External Control of File Name or Path through the cache path construction process. An attacker can write arbitrary files outside the intended cache directory and delete directories accessible by the process by supplying crafted GitHub template URIs containing path traversal sequences.

Upgrade PraisonAI to version 4.6.59 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Directory Traversal via the multiedit function, which lacks path validation, workspace boundary checks, and protected path guards. An attacker can read or overwrite arbitrary files accessible to the process user by supplying crafted file paths as arguments, potentially exposing sensitive information or modifying critical files.

Upgrade PraisonAI to version 4.6.62 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Improper Authentication via the verify_token function. An attacker can gain unauthorized access to the agent invocation API by setting the PRAISONAI_CALL_AUTH environment variable to disabled, which unconditionally skips authentication checks. This is only exploitable if the environment variable is explicitly set to disabled in the deployment configuration.

Upgrade PraisonAI to version 4.6.62 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Incorrect Authorization in the app_mention event handler, which fails to enforce user and channel authorization checks. An attacker can gain unauthorized access to agent functionality and potentially impact confidentiality and integrity by mentioning the bot in a Slack channel where the app is present, even if the user or channel is not authorized.

Upgrade PraisonAI to version 4.6.59 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the HTTPApproval process. An attacker can execute arbitrary JavaScript in the context of the approval dashboard by injecting malicious tool arguments, which can result in unauthorized approval of dangerous tool actions without explicit human consent.

Upgrade PraisonAI to version 4.6.59 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Information Exposure via the artifact_head, artifact_tail, artifact_grep, and artifact_chunk functions. An attacker can access sensitive files on the host system by supplying arbitrary file paths to these functions, allowing disclosure of confidential information such as environment files, credentials, SSH keys, and other local data readable by the process.

Upgrade PraisonAI to version 4.6.59 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Information Exposure via the history_tail, history_get, terminal_tail, and terminal_grep functions when user-supplied run_id and agent_id values are used to construct file paths without proper validation. An attacker can access sensitive files outside the intended storage directory by supplying crafted path traversal values.

Upgrade PraisonAI to version 4.6.59 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Directory Traversal via the agent_file field in the Jobs API. An attacker can access arbitrary files on the server by supplying an absolute filesystem path without authentication or path validation.

Upgrade PraisonAI to version 4.6.59 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Missing Authorization via the unauthenticated create_app process. An attacker can execute arbitrary code, access sensitive job data, and disrupt service by submitting, reading, canceling, or deleting jobs through exposed API endpoints without any authentication or authorization checks.

Upgrade PraisonAI to version 4.6.59 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Insecure Default Initialization of Resource in the dispatch process of the authentication middleware when no secret is configured. An attacker can gain unauthorized access to recipe execution endpoints, trigger arbitrary recipe executions, read sensitive inputs and outputs, and potentially achieve remote code execution by sending unauthenticated requests. This is only exploitable if authentication is enabled in the configuration but the required secret (API key or JWT secret) is not set in either the configuration file or environment variables.

Upgrade PraisonAI to version 4.6.59 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Missing Authorization via the AgentOS process. An attacker can gain unauthorized access to agent metadata and invoke agent actions by sending unauthenticated or incorrectly authenticated requests to the /api/agents and /api/chat endpoints. This can result in enumeration of deployed agents, reading sensitive agent information, triggering downstream tools or integrations, and consuming resources through repeated invocation.

Upgrade PraisonAI to version 4.6.59 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the webhook process when the secret environment variable is unset, causing signature verification to be skipped. An attacker can inject arbitrary platform events and impersonate users by sending crafted requests to the webhook endpoint.

Upgrade PraisonAI to version 4.6.59 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Insecure Default Initialization of Resource due to the check_auth function in the generated Flask server, which accepts all requests without authentication by default. An attacker can gain unauthorized access to sensitive endpoints and execute arbitrary actions by sending crafted requests to the exposed API.

Upgrade PraisonAI to version 4.6.40 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the verify_token authentication process when the required environment variable is unset. An attacker can gain unauthorized access to sensitive agent-control endpoints by sending unauthenticated requests to the server. This is only exploitable if the server is started without the necessary authentication token configured.

Upgrade PraisonAI to version 4.6.40 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the calculate function. An attacker can execute arbitrary Python code in the server process by sending a crafted JSON-RPC request to the unauthenticated /a2a endpoint, which is processed by the LLM agent and results in the invocation of the unsafe tool. This can lead to full compromise of server privileges, file read/write access, credential exposure, and denial of service. This is only exploitable if the server is deployed with the unauthenticated A2A example, binds to a public interface, and registers a tool that evaluates attacker-controlled input.

Upgrade PraisonAI to version 4.6.40 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Incorrect Authorization in the DiscordApproval process. An attacker can gain unauthorized approval for high-risk tool executions by posting an approval-like message (such as 'yes') in the configured Discord channel after an approval prompt appears, without being an intended approver or replying directly to the approval request. This can result in execution of privileged operations, file modifications, deployment changes, or data access with the privileges of the application process.

Upgrade PraisonAI to version 4.6.59 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Incorrect Authorization via the CODE_TOOLS wrappers and related file operation functions when the workspace boundary is unset. An attacker can read and modify files outside the intended project workspace by influencing prompt-driven tool calls before a workspace is configured.

Upgrade PraisonAI to version 4.6.59 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the api_mcp_connect endpoint in the UI host application. An attacker can execute arbitrary local commands as the service user by sending crafted HTTP POST requests containing attacker-controlled command and args fields. This allows for actions such as exfiltrating secrets, modifying files, or disrupting services remotely without authentication.

Upgrade PraisonAI to version 4.6.59 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Missing Authorization through the run_sse process. An attacker can gain unauthorized access to registered tools and interact with them by leveraging DNS rebinding and sending crafted requests with attacker-controlled Host and Origin headers. This can result in exposure, modification, or disruption of local or internal resources accessible by the exposed tools. This is only exploitable if a user starts a local or internal legacy SSE MCP server and visits a malicious website.

Upgrade PraisonAI to version 4.6.59 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Incorrect Authorization via the submit_job process. An attacker can execute arbitrary OS commands on the server by submitting a crafted YAML payload to the unauthenticated API endpoint, which leverages the approve field to bypass approval checks and invoke dangerous functionality.

Upgrade PraisonAI to version 4.6.59 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Unsafe Dependency Resolution in the load_tools_from_module and load_tools_from_module_class functions, which accept a module_path parameter from YAML configuration and execute it using spec.loader.exec_module without validation or gating. An attacker can execute arbitrary code with the privileges of the running process by supplying a crafted module path via a writable configuration directory, remote recipe fetch, or prompt injection.

Note: This is only exploitable if an attacker can control the YAML configuration or place a malicious Python file accessible to the process.

Upgrade PraisonAI to version 4.6.38 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Missing Authorization via the workflow.show, workflow.validate, and deploy.validate handlers, which accept file path arguments without proper containment checks. An attacker can access and exfiltrate arbitrary files readable by the host user by sending unauthenticated requests to the exposed MCP server endpoints.

Note: This is only exploitable if the server is running with default authentication disabled (i.e., api_key=None), which is the documented default configuration.

Upgrade PraisonAI to version 4.6.40 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Directory Traversal through the write_file function when path validation is skipped if workspace is set to None. An attacker can cause arbitrary files to be written to attacker-specified locations by embedding hidden metadata in a webpage that is processed by the API.

Upgrade PraisonAI to version 4.6.40 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere via the direct-prompt CLI. An attacker can access sensitive local HTTP resources by crafting prompt text containing @url: mentions that reference loopback or private network addresses, causing the system to fetch and inject the response body into the model prompt context.

Upgrade PraisonAI to version 4.6.40 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via improper URL validation the spider_tools component. An attacker can access internal loopback-only HTTP services by supplying specially crafted URLs that use alternate encodings of loopback addresses, bypassing insufficient validation checks.

Upgrade PraisonAI to version 4.6.40 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Protection Mechanism Failure in the execute_code() function. An attacker can achieve arbitrary command execution on the host system by leveraging access to print.__self__ to retrieve the real builtins module, extracting sensitive functions such as __import__ through dynamic attribute access and runtime string construction, and bypassing AST-based security checks. This allows reading and writing files, exfiltrating environment variables, and executing further malicious actions.

Upgrade PraisonAI to version 4.6.40 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Directory Traversal through the _safe_extractall process. An attacker can write arbitrary files outside the intended destination directory by crafting a tar archive containing a symlink with a linkname pointing outside the target directory, followed by a regular file whose path traverses the created symlink.

Upgrade PraisonAI to version 4.6.37 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') in the ToolExecutionMixin.execute_tool process. An attacker can execute arbitrary callables defined in the __main__ module by supplying crafted tool-call names that are not declared in the tool list or registry.

Upgrade PraisonAI to version 4.6.37 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Directory Traversal via the tools/call process. An attacker can execute arbitrary code by supplying crafted path arguments that escape the intended directory and write malicious .pth files into the user's Python site-packages directory, which are then executed in subsequent Python processes.

Upgrade PraisonAI to version 4.6.34 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to SQL Injection via the process that constructs SQL and CQL queries using unvalidated collection names. An attacker can execute unauthorized database commands by supplying specially crafted input.

Upgrade PraisonAI to version 4.6.34 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the legacy API server when authentication is disabled by default. An attacker can execute arbitrary workflows and access sensitive endpoints by sending unauthenticated requests to exposed API routes.

Upgrade PraisonAI to version 4.6.34 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Command Injection via the parse_mcp_command function. An attacker can execute arbitrary system commands by supplying malicious input that is passed directly to subprocess execution without validation.

Upgrade PraisonAI to version 4.5.149 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Arbitrary Code Injection through the automatic loading of the tools.py file from the current working directory using importlib.util.spec_from_file_location and immediate execution via spec.loader.exec_module(). An attacker can execute arbitrary code by placing a malicious tools.py file in the working directory where the application is started.

Note: This is only exploitable if an attacker is able to write a file named tools.py to the working directory prior to application startup.

Upgrade PraisonAI to version 4.5.140 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to SQL Injection in the handling of the table_prefix and schema parameters in multiple conversation store backends, where these values are interpolated directly into SQL statements without proper validation. An attacker can execute arbitrary SQL commands by supplying crafted input to these parameters, potentially gaining unauthorized access to, modifying, or deleting database contents. This is only exploitable if the table_prefix or schema values are derived from untrusted external sources, such as user-controlled configuration, API requests, or multi-tenant setups.

Upgrade PraisonAI to version 4.5.149 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Arbitrary Code Injection via the create_agent_centric_tools function. An attacker can execute arbitrary code by supplying crafted template expressions in user input that is rendered without proper escaping.

Upgrade PraisonAI to version 4.5.114 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the home function. An attacker can steal cookies or session tokens from users viewing the API output and perform actions in the context of the victim's browser session by injecting malicious HTML or script tags through agent-controlled input.

Note: This is only exploitable if the nh3 library is not installed, as the fallback sanitizer does not modify the HTML output.

Upgrade PraisonAI to version 4.5.126 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the content_length parameter. An attacker can exhaust system memory and potentially fill disk storage by sending large HTTP POST requests with arbitrary Content-Length headers, causing the server to read and process excessively large request bodies without size limits. This can lead to server crashes and denial of service.

Upgrade PraisonAI to version 4.5.126 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Declaration of Catch for Generic Exception through the /api/approval/allow-list endpoint when no authentication token is configured. An attacker can gain unauthorized access to modify the allowlist and enable auto-approval of dangerous tools by sending crafted POST requests.

Note: This is only exploitable if the authentication token is not set in the configuration.

Upgrade PraisonAI to version 4.5.128 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to SQL Injection via the table_prefix configuration parameter when constructing SQL queries. An attacker can access unauthorized data and manipulate query results by supplying crafted input to the configuration, which is then concatenated into SQL statements without validation.

Upgrade PraisonAI to version 4.5.133 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) via the _safe_extractall function. An attacker can cause disk exhaustion and disrupt service availability by publishing a malicious compressed archive containing highly compressible data, which is then extracted without size limits during the pull action.

Upgrade PraisonAI to version 4.5.126 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the webhook_url parameter in the Jobs API. An unauthenticated attacker can cause the server to send HTTP POST requests to arbitrary internal or external destinations by submitting a crafted value, potentially accessing internal services, cloud metadata endpoints, or exfiltrating sensitive job results to attacker-controlled servers.

Note: This is only exploitable if the server is deployed with the default configuration that lacks authentication and URL validation.

Upgrade PraisonAI to version 4.5.126 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Incorrect Authorization due to the hardcoded override of the administrator's approval configuration in the approval_mode module. A user can execute arbitrary shell commands on the server by instructing the LLM agent through the user interface, bypassing intended human approval gates.

Upgrade PraisonAI to version 4.5.126 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Directory Traversal via the cmd_unpack function. An attacker can overwrite arbitrary files on the filesystem by crafting a malicious archive containing directory traversal sequences in member names and convincing a user to unpack it. This allows the attacker to control both the path and content of files written outside the intended extraction directory.

Upgrade PraisonAI to version 4.5.126 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the handle_media_stream function. An attacker can exhaust server resources, drain API credits, and deny service to legitimate users by establishing multiple unauthenticated WebSocket connections and sending large or numerous messages.

Upgrade PraisonAI to version 4.5.126 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Unsafe Dependency Resolution in the exec_module function. An attacker can gain unauthorized access to sensitive data and execute arbitrary commands by crafting a malicious template that, when installed and run, automatically executes code with the user's privileges.

Upgrade PraisonAI to version 4.5.140 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Arbitrary Argument Injection via the deploy.py file. An attacker can inject arbitrary environment variables into the deployed Cloud Run service by supplying comma characters in the values of environment variables or configuration fields that are interpolated into the --set-env-vars argument. This allows overriding sensitive settings, redirecting traffic, or exposing confidential data by manipulating the deployment environment.

Note: We have not independently validated this fix and recommend limiting the packages available for use by the agent packages to reduce supply chain risk.

Upgrade PraisonAI to version 4.5.128 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains in the POST /agui endpoint due to the absence of authentication and the use of a hardcoded Access-Control-Allow-Origin: * header. An attacker can execute arbitrary agent actions and exfiltrate sensitive data by luring a victim to visit a malicious website, which then sends crafted cross-origin requests to a locally running server.

Note: This is only exploitable if the AGUI server is running locally and the victim visits an attacker-controlled website.

Upgrade PraisonAI to version 4.5.125 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Command Injection via the execute_command function and related workflow execution processes. A user can execute arbitrary system commands with the privileges of the running process by supplying crafted input containing shell metacharacters through YAML workflow definitions, agent configuration files, LLM-generated tool calls, or recipe step configurations.

Upgrade PraisonAI to version 4.5.121 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Relative Path Traversal in the extractall function. An attacker can overwrite arbitrary files on the filesystem by supplying a specially crafted ZIP archive containing file paths with directory traversal sequences.

Upgrade PraisonAI to version 4.5.113 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Directory Traversal through the Action Orchestrator feature. An attacker can overwrite or create arbitrary files on the host system by supplying crafted path traversal sequences in the step.target parameter. This can result in the execution of malicious code or corruption of system files by leveraging file creation or modification actions.

Upgrade PraisonAI to version 4.5.113 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Arbitrary File Upload through the pull flow. An attacker can create or overwrite files outside the intended output directory by publishing a specially crafted archive containing directory traversal entries, which are then extracted without validation when another user pulls the recipe.

Upgrade PraisonAI to version 4.5.113 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the start_session parameter. An attacker can gain unauthorized access to active browser automation sessions and receive sensitive automation output by connecting to the exposed WebSocket endpoint without authentication or an Origin header.

Upgrade PraisonAI to version 4.5.140 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Arbitrary Code Injection via the JobWorkflowExecutor class. An attacker can execute arbitrary commands and code on the host system by supplying a malicious YAML file containing crafted run, script, or python steps that are processed without proper validation.

Upgrade PraisonAI to version 4.5.140 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Untrusted Search Path via the import_tools_from_file function. An attacker can execute arbitrary code by placing a malicious tools.py file in the working directory, which is automatically imported and executed by the application components.

Upgrade PraisonAI to version 4.5.140 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Environmental Variables in the execute_command function, where environment variables within command arguments and the cwd parameter are expanded using os.path.expandvars before execution. An attacker can obtain sensitive environment variable values, such as database credentials or API keys, by crafting commands that reference these variables. This can be achieved through prompt injection or by submitting commands for approval that appear benign but result in secret exfiltration upon execution.

Note: This is only exploitable if the approval system is bypassed or misleads reviewers by displaying unexpanded variables, or if automated approval is enabled via the PRAISONAI_AUTO_APPROVE environment variable.

Upgrade PraisonAI to version 4.5.135 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the create_a2u_routes function. An attacker can access sensitive agent activity, including responses, internal reasoning, and tool call arguments, by subscribing to the event stream endpoints without authentication.

Upgrade PraisonAI to version 4.5.114 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data through the YAML deserialization in the loadAgentFromFile function. An attacker can execute arbitrary code on the server by uploading a specially crafted YAML file containing malicious tags via the API endpoint.

Upgrade PraisonAI to version 4.5.114 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Arbitrary Code Injection via the execute_code function. An attacker can gain unauthorized access to the host environment, execute arbitrary commands, read and write files, exfiltrate environment variables, and perform other malicious actions by submitting specially crafted code that exploits insufficient attribute blocking in the sandboxed subprocess execution.

Upgrade PraisonAI to version 4.5.114 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Directory Traversal in the MultiAgentLedger and MultiAgentMonitor components. An attacker can access sensitive context data belonging to other agents by registering with the same agent ID, or read and write arbitrary files on the system by supplying a crafted agent ID containing path traversal sequences.

Upgrade PraisonAI to version 4.5.114 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Directory Traversal via the recipe registry publish endpoint. An attacker can create or overwrite files outside the intended directory by submitting a crafted bundle containing directory traversal sequences in the manifest fields. This can lead to unauthorized modification of files on the server, potentially impacting system integrity and availability.

Upgrade PraisonAI to version 4.5.113 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Command Injection via the run_python function. An attacker can execute arbitrary operating system commands by supplying specially crafted input that is interpolated into a shell command and executed with insufficient escaping.

Note: This is only exploitable if the Flask server is deployed with authentication disabled.

Upgrade PraisonAI to version 4.5.125 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to SQL Injection via the get_all_user_threads function. An attacker can gain unauthorized access to sensitive database contents and perform arbitrary database operations by injecting malicious payloads into thread IDs that are later incorporated into raw SQL queries.

Upgrade PraisonAI to version 4.5.90 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Command Injection in the SubprocessSandbox module due to the use of shell=True in subprocess.run() combined with an incomplete blocklist that does not prevent execution of sh or bash. An attacker can execute arbitrary system commands by bypassing the blocklist using shell invocation techniques.

Note: This is only exploitable if the sandbox is configured in STRICT mode and untrusted input is passed to the sandbox execution process.

Upgrade PraisonAI to version 4.5.96 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Command Injection via the parse_mcp_command function. An attacker can execute arbitrary operating system commands by supplying crafted input to the --mcp argument, which is passed without validation to process creation functions.

Upgrade PraisonAI to version 4.5.69 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the search_tools function. An attacker can cause prolonged blocking of the Python thread and a complete service outage by submitting a specially crafted regular expression that triggers catastrophic backtracking.

Upgrade PraisonAI to version 4.5.90 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the passthrough function when the api_base parameter is not validated before being concatenated with endpoint and passed to httpx.Client.request. An attacker can access internal or sensitive resources by supplying a crafted api_base value that points to internal network services or cloud metadata endpoints.

Upgrade PraisonAI to version 4.5.90 or higher.

PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration.

Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the websocket_endpoint function. An attacker can gain unauthorized access to sensitive agent information and perform arbitrary actions, such as sending messages to agents, executing tools, reading files, and making API calls, by connecting to the WebSocket gateway and accessing the /info endpoint without authentication.

Upgrade PraisonAI to version 4.5.96 or higher.