# cve.now: Mervinpraison

The newest entries naming Mervinpraison as an affected vendor (up to 200), of 178 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-57117](https://cve.now/CVE-2026-57117.md): PraisonAI: Compute-bridged file tools allow shell command injection (CVSS 8.8)
- [CVE-2026-57146](https://cve.now/CVE-2026-57146.md): PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default (CVSS 7.5)
- [CVE-2026-57144](https://cve.now/CVE-2026-57144.md): PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable (CVSS 8.8)
- [CVE-2026-57142](https://cve.now/CVE-2026-57142.md): PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml (CVSS 7.8)
- [CVE-2026-57121](https://cve.now/CVE-2026-57121.md): PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API (CVSS 8.1)
- [CVE-2026-57116](https://cve.now/CVE-2026-57116.md): PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation (CVSS 9.8)
- [CVE-2026-57114](https://cve.now/CVE-2026-57114.md): PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding (CVSS 7.2)
- [CVE-2026-57113](https://cve.now/CVE-2026-57113.md): PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion (CVSS 8.1)
- [CVE-2026-56840](https://cve.now/CVE-2026-56840.md): PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools (CVSS 8.8)
- [CVE-2026-56838](https://cve.now/CVE-2026-56838.md): PraisonAI recipe.run\_stream skips dangerous-tool policy enforcement (CVSS 7.8)
- [CVE-2026-56837](https://cve.now/CVE-2026-56837.md): PraisonAI LinearBot processes unsigned webhooks when LINEAR\_WEBHOOK\_SECRET is missing (CVSS 8.6)
- [CVE-2026-56836](https://cve.now/CVE-2026-56836.md): PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard (CVSS 8.2)
- [CVE-2026-56835](https://cve.now/CVE-2026-56835.md): PraisonAI Slack app\_mention bypasses configured user/channel authorization (CVSS 8.3)
- [CVE-2026-56834](https://cve.now/CVE-2026-56834.md): PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage (CVSS 7.5)
- [CVE-2026-56833](https://cve.now/CVE-2026-56833.md): PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal (CVSS 7.5)
- [CVE-2026-56832](https://cve.now/CVE-2026-56832.md): PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals (CVSS 8.8)
- [CVE-2026-57118](https://cve.now/CVE-2026-57118.md): PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints (CVSS 9.8)
- [CVE-2026-57143](https://cve.now/CVE-2026-57143.md): PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search\_web tools via attacker-controlled searxng\_url parameter (CVSS 8.8)
- [CVE-2026-62176](https://cve.now/CVE-2026-62176.md): PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation (CVSS 9.1)
- [CVE-2026-62179](https://cve.now/CVE-2026-62179.md): PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues (CVSS 6.5)
- [CVE-2026-57147](https://cve.now/CVE-2026-57147.md): praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery (CVSS 9.8)
- [CVE-2026-57148](https://cve.now/CVE-2026-57148.md): praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard) (CVSS 9.8)
- [CVE-2026-57140](https://cve.now/CVE-2026-57140.md): PraisonAI AgentOS exposes unauthenticated agent listing and invocation (CVSS 9.4)
- [CVE-2026-57139](https://cve.now/CVE-2026-57139.md): PraisonAI MCPServer exposes unauthenticated HTTP tools/call (CVSS 9.8)
- [CVE-2026-57133](https://cve.now/CVE-2026-57133.md): PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining (CVSS 8.8)
- [CVE-2026-57135](https://cve.now/CVE-2026-57135.md): PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients (CVSS 7.6)
- [CVE-2026-57134](https://cve.now/CVE-2026-57134.md): PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation (CVSS 8.2)
- [CVE-2026-57138](https://cve.now/CVE-2026-57138.md): PraisonAI codeMode sandbox escape via Function constructor (CVSS 9.9)
- [CVE-2026-57136](https://cve.now/CVE-2026-57136.md): PraisonAI SandboxExecutor allowedCommands bypass via shell chaining (CVSS 8.8)
- [CVE-2026-57137](https://cve.now/CVE-2026-57137.md): PraisonAI AgentLoop onToolCall approval runs after tool execution (CVSS 8.8)
- [CVE-2026-57141](https://cve.now/CVE-2026-57141.md): PraisonAI: Remote Code Execution via Sandbox Escape in \`codeMode\` Tool (CVSS 9.8)
- [CVE-2026-57112](https://cve.now/CVE-2026-57112.md): PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools (CVSS 8.3)
- [CVE-2026-57145](https://cve.now/CVE-2026-57145.md): PraisonAI: Arbitrary File Read/Write via \`multiedit\` Tool Without Path Validation (CVSS 9.1)
- [CVE-2026-57132](https://cve.now/CVE-2026-57132.md): PraisonAI: PRAISONAI\_CALL\_AUTH=disabled environment variable unconditionally disables authentication (CVSS 8.2)
- [CVE-2026-57131](https://cve.now/CVE-2026-57131.md): praisonai: Jobs API exposes agent-execution endpoints with no authentication (CVSS 9.8)
- [CVE-2026-57124](https://cve.now/CVE-2026-57124.md): PraisonAI UI MCP connect endpoint allows unauthenticated local command execution (CVSS 9.8)
- [CVE-2026-57122](https://cve.now/CVE-2026-57122.md): PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots) (CVSS 8.6)
- [CVE-2026-57127](https://cve.now/CVE-2026-57127.md): praisonai: recipe serve auth middleware silently disables itself when no secret is set (CVSS 9.8)
- [CVE-2026-56839](https://cve.now/CVE-2026-56839.md): PraisonAI Code agent tools fail open without a workspace boundary (CVSS 7.3)
- [CVE-2026-57119](https://cve.now/CVE-2026-57119.md): PraisonAI: Unauthenticated Local File Inclusion via agent\_file path in the Jobs API (CVSS 7.5)
- [CVE-2026-57129](https://cve.now/CVE-2026-57129.md): PraisonAI: Arbitrary File Read via \`@file:\` Mention Path Traversal (CVSS 7.5)
- [CVE-2026-57126](https://cve.now/CVE-2026-57126.md): praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS (CVSS 8.5)
- [CVE-2026-57120](https://cve.now/CVE-2026-57120.md): PraisonAI: execute\_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunder (CVSS 6.5)
- [CVE-2026-57123](https://cve.now/CVE-2026-57123.md): PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in (CVSS 9.8)
- [CVE-2026-57130](https://cve.now/CVE-2026-57130.md): PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters (CVSS 8.1)
- [CVE-2026-57128](https://cve.now/CVE-2026-57128.md): PraisonAI: Unauthenticated Event Injection via SSE \`/publish\` Endpoint (CVSS 4.3)
- [CVE-2026-57115](https://cve.now/CVE-2026-57115.md): PraisonAI: SpiderTools redirect-target SSRF protection bypass (CVSS 6.5)
- [CVE-2026-57125](https://cve.now/CVE-2026-57125.md): PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass (CVSS 9.8)
- [CVE-2026-55536](https://cve.now/CVE-2026-55536.md): Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92) (CVSS 9.1)
- [CVE-2026-55532](https://cve.now/CVE-2026-55532.md): PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server (CVSS 7.6)
- [CVE-2026-55533](https://cve.now/CVE-2026-55533.md): PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret (CVSS 8.2)
- [CVE-2026-55539](https://cve.now/CVE-2026-55539.md): PraisonAI: \[Auth Bypass\] PraisonAI async Jobs API (\`/api/v1/runs\`) has no authentication — unauthenticated job execution, result theft, cancel and delete (CVSS 8.6)
- [CVE-2026-55527](https://cve.now/CVE-2026-55527.md): PraisonAI: Arbitrary file write via unsanitized \`user\_id\` in \`FileMemory.\_\_init\_\_()\` — path traversal to any writable location (CVSS 7.1)
- [CVE-2026-55541](https://cve.now/CVE-2026-55541.md): PraisonAI: \`--api-key\` flag on \`praisonai serve\` is not properly enforced (CVSS 8.8)
- [CVE-2026-55535](https://cve.now/CVE-2026-55535.md): PraisonAI: Server-Side Request Forgery via DNS rebinding bypass in webhook\_url validation (CVSS 6.8)
- [CVE-2026-55537](https://cve.now/CVE-2026-55537.md): PraisonAI: Webhook SSRF via DNS fail-open in \`JobSubmitRequest.validate\_webhook\_url()\` — bypass of CVE-2026-40114 (CVSS 7.1)
- [CVE-2026-55538](https://cve.now/CVE-2026-55538.md): PraisonAI: \[Auth Bypass\] \`praisonai serve agents --api-key\` is silently ignored — agent-invocation routes (\`POST /agents\`, \`POST /agents/{agent\_name}\`) run unauthenticated (CVSS 7.3)
- [CVE-2026-55540](https://cve.now/CVE-2026-55540.md): PraisonAI: \[Path Traversal\] agent tools escape the configured workspace via symlinks (CVSS 7.1)
- [CVE-2026-55530](https://cve.now/CVE-2026-55530.md): PraisonAI: ast\_grep\_rewrite rewrites arbitrary files without the @require\_approval gate enforced on every sibling mutation tool (CVSS 6.1)
- [CVE-2026-55534](https://cve.now/CVE-2026-55534.md): PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution (CVSS 8.6)
- [CVE-2026-55526](https://cve.now/CVE-2026-55526.md): PraisonAI: SSRF protection bypass in \`spider\_tools.\_host\_is\_blocked()\` via DNS-resolved hostnames (\`127.0.0.1.nip.io\`) (CVSS 8.5)
- [CVE-2026-55531](https://cve.now/CVE-2026-55531.md): PraisonAI: Unauthenticated unbounded session accumulation in the PraisonAI MCP HTTP server (memory exhaustion; session TTL never enforced) (CVSS 6.5)
- [CVE-2026-55528](https://cve.now/CVE-2026-55528.md): praisonaiagents: AgentServer declares auth\_token but never enforces it on any route (CWE-862) (CVSS 8.2)
- [CVE-2026-55529](https://cve.now/CVE-2026-55529.md): PraisonAI: Origin validation bypass in MCP HTTP Stream transport allows browser-mediated unauthenticated tool execution on local MCP server (CVSS 6.9)
- [CVE-2026-55525](https://cve.now/CVE-2026-55525.md): PraisonAI: SSRF via redirect-following in praisonaiagents web\_crawl (CVSS 7.5)
- [CVE-2026-48169](https://cve.now/CVE-2026-48169.md): PraisonAI has Cross-Workspace IDOR and Privilege Escalation via Platform API (CVSS 8.8)
- [CVE-2026-55524](https://cve.now/CVE-2026-55524.md): PraisonAI: SSRF in web\_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap) (CVSS 7.5)
- [CVE-2026-55523](https://cve.now/CVE-2026-55523.md): PraisonAI has a\`web\_crawl\` SSRF protection bypass via unchecked redirect targets (CVSS 7.7)
- [CVE-2026-55522](https://cve.now/CVE-2026-55522.md): PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code (CVSS 7.8)
- [CVE-2026-48168](https://cve.now/CVE-2026-48168.md): PraisonAI: GitHub Actions Claude workflow command injection via unquoted PR branch name (CVSS 10.0)
- [CVE-2026-47419](https://cve.now/CVE-2026-47419.md): praisonai-platform: Agent endpoints accept any agent\_id without workspace ownership check, cross-workspace read/update/delete IDOR (CVSS 8.3)
- [CVE-2026-47418](https://cve.now/CVE-2026-47418.md): praisonai-platform: Project endpoints accept any project\_id without workspace ownership check, cross-workspace read/update/delete IDOR (CVSS 8.1)
- [CVE-2026-47417](https://cve.now/CVE-2026-47417.md): praisonai-platform: Comment endpoints accept any issue\_id without workspace ownership check, cross-workspace comment read and post IDOR (CVSS 8.1)
- [CVE-2026-47416](https://cve.now/CVE-2026-47416.md): praisonai-platform: Any workspace member can promote themselves (or any other member) to owner via PATCH /workspaces/{id}/members/{user\_id} (CVSS 9.6)
- [CVE-2026-47415](https://cve.now/CVE-2026-47415.md): praisonai-platform: Issue endpoints accept any issue\_id without workspace ownership check, cross-workspace read/update/delete IDOR (CVSS 8.3)
- [CVE-2026-47414](https://cve.now/CVE-2026-47414.md): praisonai-platform: Label endpoints accept any label\_id and any issue\_id without workspace ownership check, cross-workspace label edit/delete and issue-label-link IDOR (CVSS 7.6)
- [CVE-2026-47413](https://cve.now/CVE-2026-47413.md): praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members (CVSS 9.6)
- [CVE-2026-47412](https://cve.now/CVE-2026-47412.md): praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id} (CVSS 8.1)
- [CVE-2026-47411](https://cve.now/CVE-2026-47411.md): praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id} (CVSS 6.5)
- [CVE-2026-47410](https://cve.now/CVE-2026-47410.md): praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM\_ENV is unset (CVSS 9.8)
- [CVE-2026-47409](https://cve.now/CVE-2026-47409.md): praisonai-platform: Any workspace member can remove any other member (including the owner) via DELETE /workspaces/{id}/members/{user\_id} (CVSS 8.1)
- [CVE-2026-47408](https://cve.now/CVE-2026-47408.md): praisonai-platform: list\_issue\_activity returns activity log for any issue regardless of workspace ownership (CVSS 6.5)
- [CVE-2026-47407](https://cve.now/CVE-2026-47407.md): PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation (CVSS 9.4)
- [CVE-2026-47406](https://cve.now/CVE-2026-47406.md): praisonai-platform: Dependency endpoints accept any issue\_id and dep\_id without workspace ownership check, cross-workspace issue linking + read + delete IDOR (CVSS 8.1)
- [CVE-2026-47405](https://cve.now/CVE-2026-47405.md): PraisonAI Platform missing role checks let any workspace member become owner and take over workspace membership (CVSS 8.8)
- [CVE-2026-47399](https://cve.now/CVE-2026-47399.md): PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID (CVSS 8.8)
- [CVE-2026-47398](https://cve.now/CVE-2026-47398.md): PraisonAI: Arbitrary code execution via unguarded \`spec.loader.exec\_module\` in \`agents\_generator.py\` - sibling of CVE-2026-44334 (CVSS 8.1)
- [CVE-2026-47397](https://cve.now/CVE-2026-47397.md): PraisonAI has an Arbitrary File Write in Python API (CVSS 7.1)
- [CVE-2026-47396](https://cve.now/CVE-2026-47396.md): PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL\_SERVER\_TOKEN is unset (CVSS 9.8)
- [CVE-2026-47395](https://cve.now/CVE-2026-47395.md): PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context (CVSS 5.5)
- [CVE-2026-47394](https://cve.now/CVE-2026-47394.md): PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate (CVSS 8.7)
- [CVE-2026-47393](https://cve.now/CVE-2026-47393.md): PraisonAI \`deploy --type api\` emits a Flask server with authentication disabled by default (CVSS 9.8)
- [CVE-2026-47392](https://cve.now/CVE-2026-47392.md): PraisonAI vulnerable to sandbox escape via \`print.\_\_self\_\_\` builtins module leak in \`execute\_code\` (subprocess mode) (CVSS 9.9)
- [CVE-2026-47391](https://cve.now/CVE-2026-47391.md): PraisonAI's unauthenticated A2A official example can reach real LLM-driven \`eval()\` tool execution (CVSS 9.8)
- [CVE-2026-47390](https://cve.now/CVE-2026-47390.md): PraisonAI spider\_tools SSRF protection bypass via alternate loopback host encodings (CVSS 5.5)
- [CVE-2026-61446](https://cve.now/CVE-2026-61446.md): PraisonAI before 1.6.78 Remote Code Execution via Plugin Auto-Discovery (CVSS 8.6)
- [CVE-2026-61443](https://cve.now/CVE-2026-61443.md): PraisonAI before 1.6.78 Remote Code Execution via SkillTools (CVSS 8.6)
- [CVE-2026-61440](https://cve.now/CVE-2026-61440.md): PraisonAI Platform before 0.1.9 Authorization Bypass via Label Endpoints (CVSS 7.1)
- [CVE-2026-61438](https://cve.now/CVE-2026-61438.md): PraisonAI before 4.6.78 Remote Code Execution via Broken AST Sandbox (CVSS 7.0)
- [CVE-2026-61436](https://cve.now/CVE-2026-61436.md): PraisonAI before 4.6.78 Missing Webhook Signature Verification (CVSS 8.8)
- [CVE-2026-61435](https://cve.now/CVE-2026-61435.md): PraisonAI before 4.6.78 Authentication Bypass via Host Header Spoofing (CVSS 8.8)
- [CVE-2026-61433](https://cve.now/CVE-2026-61433.md): PraisonAI before 4.6.78 Code Injection via API deployment generator (CVSS 8.5)
- [CVE-2026-61430](https://cve.now/CVE-2026-61430.md): PraisonAI before 1.6.78 DNS Rebinding SSRF via web\_crawl (CVSS 8.4)
- [CVE-2026-61427](https://cve.now/CVE-2026-61427.md): PraisonAI before 4.6.78 Authentication Bypass via HTTP-stream (CVSS 6.9)
- [CVE-2026-60087](https://cve.now/CVE-2026-60087.md): PraisonAI before 1.6.78 Tool Approval Cache Bypass (CVSS 6.9)
- [CVE-2026-60085](https://cve.now/CVE-2026-60085.md): PraisonAI before 4.6.78 Unenforced Security Policy in Subprocess Sandbox (CVSS 8.7)
- [CVE-2026-61447](https://cve.now/CVE-2026-61447.md): PraisonAI before 1.6.78 Remote Code Execution via CodeAgent (CVSS 10.0)
- [CVE-2026-61445](https://cve.now/CVE-2026-61445.md): PraisonAI before 4.6.78 Arbitrary File Write and Command Execution (CVSS 9.4)
- [CVE-2026-61442](https://cve.now/CVE-2026-61442.md): PraisonAI Platform before 0.1.9 Authorization Bypass via PATCH (CVSS 7.1)
- [CVE-2026-61439](https://cve.now/CVE-2026-61439.md): PraisonAI before 4.6.78 Prompt Injection Defense Bypass (CVSS 8.7)
- [CVE-2026-61429](https://cve.now/CVE-2026-61429.md): PraisonAI before 1.6.78 SSRF via Crawl4AI Chromium backend (CVSS 8.4)
- [CVE-2026-61428](https://cve.now/CVE-2026-61428.md): PraisonAI AgentMail before 4.6.78 Message Injection via Webhook (CVSS 6.9)
- [CVE-2026-61426](https://cve.now/CVE-2026-61426.md): PraisonAI before 1.7.3 Unauthenticated Agent Access via Insecure Defaults (CVSS 8.8)
- [CVE-2026-60090](https://cve.now/CVE-2026-60090.md): PraisonAI before 4.6.78 SQL/CQL Injection via vector dimension (CVSS 9.3)
- [CVE-2026-60088](https://cve.now/CVE-2026-60088.md): PraisonAI before 4.6.78 Path Traversal via Custom Commands (CVSS 6.8)
- [CVE-2026-61444](https://cve.now/CVE-2026-61444.md): PraisonAI before 4.6.78 Code Injection via f-string (CVSS 9.4)
- [CVE-2026-61441](https://cve.now/CVE-2026-61441.md): PraisonAI Platform before 0.1.9 Authorization Bypass via Dependencies (CVSS 7.1)
- [CVE-2026-61437](https://cve.now/CVE-2026-61437.md): PraisonAI before 1.6.78 Remote Code Execution via tools.py (CVSS 8.5)
- [CVE-2026-61434](https://cve.now/CVE-2026-61434.md): PraisonAI before 4.6.78 Allowlist Bypass via find -exec (CVSS 8.7)
- [CVE-2026-61432](https://cve.now/CVE-2026-61432.md): PraisonAI FastContext before 1.6.78 Path Traversal (CVSS 6.9)
- [CVE-2026-61431](https://cve.now/CVE-2026-61431.md): PraisonAI before 4.6.78 Path Traversal via ContextGatherer (CVSS 6.8)
- [CVE-2026-60091](https://cve.now/CVE-2026-60091.md): PraisonAI before 4.6.78 Unauthenticated SSRF via webhook\_url (CVSS 6.9)
- [CVE-2026-60089](https://cve.now/CVE-2026-60089.md): PraisonAI before 1.6.78 Path Traversal via config.toml (CVSS 6.9)
- [CVE-2026-60086](https://cve.now/CVE-2026-60086.md): PraisonAI before 4.6.78 Prompt Injection Defense Bypass (CVSS 6.9)
- [CVE-2026-44340](https://cve.now/CVE-2026-44340.md): PraisonAI: Symlink-extraction bypass of \`\_safe\_extractall\` writes outside \`dest\_dir\` (CVSS 8.7)
- [CVE-2026-44339](https://cve.now/CVE-2026-44339.md): PraisonAI has unsafe tool resolution in \`ToolExecutionMixin.execute\_tool\`: undeclared \`\_\_main\_\_\` callables execute (CVSS 8.6)
- [CVE-2026-44338](https://cve.now/CVE-2026-44338.md): PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution (CVSS 7.3)
- [CVE-2026-44337](https://cve.now/CVE-2026-44337.md): PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries (CVSS 6.3)
- [CVE-2026-44336](https://cve.now/CVE-2026-44336.md): PraisonAI MCP \`tools/call\` path-traversal and RCE via Python \`.pth\` injection (CVSS 9.4)
- [CVE-2026-44335](https://cve.now/CVE-2026-44335.md): SSRF bypass in PraisonAI (CVSS 7.7)
- [CVE-2026-44334](https://cve.now/CVE-2026-44334.md): PraisonAI: Unauthenticated RCE via \`tool\_override.py\` (CVSS 8.4)
- [CVE-2026-41497](https://cve.now/CVE-2026-41497.md): Incomplete fix for CVE-2026-34935: Command Injection in MervinPraison/PraisonAI (CVSS 9.8)
- [CVE-2026-41496](https://cve.now/CVE-2026-41496.md): PraisonAI: SQL Injection via unvalidated \`table\_prefix\` in 9 conversation store backends (incomplete fix for CVE-2026-40315) (CVSS 8.1)
- [CVE-2026-40313](https://cve.now/CVE-2026-40313.md): PraisonAI: ArtiPACKED Vulnerability via GitHub Actions Credential Persistence (CVSS 9.1)
- [CVE-2026-40289](https://cve.now/CVE-2026-40289.md): PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions (CVSS 9.1)
- [CVE-2026-40288](https://cve.now/CVE-2026-40288.md): PraisonAI: Critical RCE via \`type: job\` workflow YAML (CVSS 9.8)
- [CVE-2026-40287](https://cve.now/CVE-2026-40287.md): PraisonAI has RCE via Automatic tools.py Import (CVSS 8.4)
- [CVE-2026-40315](https://cve.now/CVE-2026-40315.md): PraisonAI: SQLiteConversationStore didn't validate table\_prefix when constructing SQL queries (CVSS 7.2)
- [CVE-2026-40160](https://cve.now/CVE-2026-40160.md): PraisonAIAgents has SSRF via unvalidated URL in \`web\_crawl\` httpx fallback (CVSS 7.1)
- [CVE-2026-40159](https://cve.now/CVE-2026-40159.md): PraisonAI Exposes Sensitive Environment Variable via Untrusted MCP Subprocess Execution (CVSS 5.5)
- [CVE-2026-40158](https://cve.now/CVE-2026-40158.md): PraisonAI has Improper Control of Generation of Code ('Code Injection') and Protection Mechanism Failure in praisonai (CVSS 8.6)
- [CVE-2026-40157](https://cve.now/CVE-2026-40157.md): PraisonAI affected by arbitrary file write via path traversal in \`praisonai recipe unpack\` (CVSS 9.4)
- [CVE-2026-40156](https://cve.now/CVE-2026-40156.md): PraisonAI Affected by Implicit Execution of Arbitrary Code via Automatic \`tools.py\` Loading (CVSS 7.8)
- [CVE-2026-40154](https://cve.now/CVE-2026-40154.md): PraisonAI Affected by Untrusted Remote Template Code Execution (CVSS 9.3)
- [CVE-2026-40151](https://cve.now/CVE-2026-40151.md): PraisonAI Affected by Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOS (CVSS 5.3)
- [CVE-2026-40153](https://cve.now/CVE-2026-40153.md): PraisonAIAgents Affected by Environment Variable Secret Exfiltration via os.path.expandvars() Bypassing shell=False in Shell Tool (CVSS 7.4)
- [CVE-2026-40152](https://cve.now/CVE-2026-40152.md): PraisonAIAgents has a Path Traversal via Unvalidated Glob Pattern in list\_files Bypasses Workspace Boundary (CVSS 5.3)
- [CVE-2026-40150](https://cve.now/CVE-2026-40150.md): PraisonAIAgents has SSRF and Local File Read via Unvalidated URLs in web\_crawl Tool (CVSS 7.7)
- [CVE-2026-40149](https://cve.now/CVE-2026-40149.md): PraisonAI has an Unauthenticated Allow-List Manipulation Bypasses Agent Tool Approval Safety Controls (CVSS 7.9)
- [CVE-2026-40148](https://cve.now/CVE-2026-40148.md): PraisonAI Affected by Decompression Bomb DoS via Recipe Bundle Extraction Without Size Limits (CVSS 6.5)
- [CVE-2026-40117](https://cve.now/CVE-2026-40117.md): PraisonAIAgents Affected by Arbitrary File Read via read\_skill\_file Missing Workspace Boundary and Approval Gate (CVSS 6.2)
- [CVE-2026-40116](https://cve.now/CVE-2026-40116.md): PraisonAI's Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate Limits (CVSS 7.5)
- [CVE-2026-40115](https://cve.now/CVE-2026-40115.md): PraisonAI has an Unrestricted Upload Size in WSGI Recipe Registry Server Enables Memory Exhaustion DoS (CVSS 6.2)
- [CVE-2026-40114](https://cve.now/CVE-2026-40114.md): PraisonAI has Server-Side Request Forgery via Unvalidated webhook\_url in Jobs API (CVSS 7.2)
- [CVE-2026-40113](https://cve.now/CVE-2026-40113.md): PraisonAI has an Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars (CVSS 8.4)
- [CVE-2026-40112](https://cve.now/CVE-2026-40112.md): PraisonAI has Stored XSS via Unsanitized Agent Output in HTML Rendering (nh3 Not a Required Dependency) (CVSS 5.4)
- [CVE-2026-40111](https://cve.now/CVE-2026-40111.md): PraisonAIAgents has an OS Command Injection via shell=True in Memory Hooks Executor (memory/hooks.py) (CVSS 9.3)
- [CVE-2026-40088](https://cve.now/CVE-2026-40088.md): Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai (CVSS 9.7)
- [CVE-2026-39891](https://cve.now/CVE-2026-39891.md): PraisonAI has a Template Injection in Agent Tool Definitions (CVSS 8.8)
- [CVE-2026-39890](https://cve.now/CVE-2026-39890.md): PraisonAI Affected by Remote Code Execution via YAML Deserialization in Agent Definition Loading (CVSS 9.8)
- [CVE-2026-39889](https://cve.now/CVE-2026-39889.md): PraisonAI has Unauthenticated SSE Event Stream Exposes All Agent Activity in A2U Server (CVSS 7.5)
- [CVE-2026-39888](https://cve.now/CVE-2026-39888.md): PraisonAIAgents has a sandbox escape via exception frame traversal in \`execute\_code\` (subprocess mode) (CVSS 10.0)
- [CVE-2026-39307](https://cve.now/CVE-2026-39307.md): PraisonAI has an Arbitrary File Write (Zip Slip) in Templates Extraction (CVSS 8.1)
- [CVE-2026-39308](https://cve.now/CVE-2026-39308.md): PraisonAI recipe registry publish path traversal allows out-of-root file write (CVSS 7.1)
- [CVE-2026-39306](https://cve.now/CVE-2026-39306.md): PraisonAI recipe registry pull path traversal writes files outside the chosen output directory (CVSS 7.3)
- [CVE-2026-39305](https://cve.now/CVE-2026-39305.md): Arbitrary File Write / Path Traversal in Action Orchestrator (CVSS 9.0)
- [CVE-2026-35615](https://cve.now/CVE-2026-35615.md): PraisonAI has a Path Traversal in FileTools (CVSS 9.2)
- [CVE-2026-34955](https://cve.now/CVE-2026-34955.md): PraisonAI: Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandbox (CVSS 8.8)
- [CVE-2026-34954](https://cve.now/CVE-2026-34954.md): PraisonAI: SSRF in FileTools.download\_file() via Unvalidated URL (CVSS 8.6)
- [CVE-2026-34953](https://cve.now/CVE-2026-34953.md): PraisonAI: Authentication Bypass in OAuthManager.validate\_token() (CVSS 9.1)
- [CVE-2026-34952](https://cve.now/CVE-2026-34952.md): PraisonAI: Missing Authentication in WebSocket Gateway (CVSS 9.1)
- [CVE-2026-34939](https://cve.now/CVE-2026-34939.md): PraisonAI: ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search\_tools() (CVSS 6.5)
- [CVE-2026-34938](https://cve.now/CVE-2026-34938.md): PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute\_code (CVSS 10.0)
- [CVE-2026-34937](https://cve.now/CVE-2026-34937.md): PraisonAI: Shell Injection in run\_python() via Unescaped $() Substitution (CVSS 7.8)
- [CVE-2026-34936](https://cve.now/CVE-2026-34936.md): PraisonAI: SSRF via Unvalidated api\_base in passthrough() Fallback (CVSS 7.7)
- [CVE-2026-34934](https://cve.now/CVE-2026-34934.md): PraisonAI: Second-Order SQL Injection in \`get\_all\_user\_threads\` (CVSS 9.8)
- [CVE-2026-34935](https://cve.now/CVE-2026-34935.md): PraisonAI: OS Command Injection in MCPHandler.parse\_mcp\_command() (CVSS 9.8)
- [CVE-2025-12019](https://cve.now/CVE-2025-12019.md): Featured Image \<= 2.1 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/mervinpraison
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.