MervinPraison vulnerabilities
We track 148 vulnerabilities in MervinPraison products across 4 products. 148 are rated high or critical, and none are known to be exploited. The most recent was published on October 23, 2026.
Latest MervinPraison vulnerabilities
- 9.6 Critical severity
PraisonAI: Inclusion of Functionality from Untrusted Control Sphere
PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI treats remotely fetched template files as trusted executable code without integrity verification, origin validation, or user confirmation, enabling supply chain attacks through malicious temp
- 7.3 High severity
PraisonAI: Declaration of Catch for Generic Exception
PraisonAI is a multi-agent teams system. Prior to 4.5.128, the gateway's /api/approval/allow-list endpoint permits unauthenticated modification of the tool approval allowlist when no auth_token is configured (the default). By adding dangerous tool names (e.g.,
- 7.5 High severity
PraisonAIAgents: Missing Authorization
PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, read_skill_file() in skill_tools.py allows reading arbitrary files from the filesystem by accepting an unrestricted skill_path parameter. Unlike file_tools.read_file which enforces workspace boun
- 7.5 High severity
PraisonAI: Allocation of Resources Without Limits or Throttling
PraisonAI is a multi-agent teams system. Prior to 4.5.128, the /media-stream WebSocket endpoint in PraisonAI's call module accepts connections from any client without authentication or Twilio signature validation. Each connection opens an authenticated session
- 7.5 High severity
PraisonAI: Allocation of Resources Without Limits or Throttling
PraisonAI is a multi-agent teams system. Prior to 4.5.128, the WSGI-based recipe registry server (server.py) reads the entire HTTP request body into memory based on the client-supplied Content-Length header with no upper bound. Combined with authentication bei
- 10.0 Critical severity
PraisonAI: Server-Side Request Forgery
PraisonAI is a multi-agent teams system. Prior to 4.5.128, the /api/v1/runs endpoint accepts an arbitrary webhook_url in the request body with no URL validation. When a submitted job completes (success or failure), the server makes an HTTP POST request to this
- 8.1 High severity
PraisonAI: Improper Neutralization of Argument Delimiters in a Command
PraisonAI is a multi-agent teams system. Prior to 4.5.128, deploy.py constructs a single comma-delimited string for the gcloud run deploy --set-env-vars argument by directly interpolating openai_model, openai_key, and openai_base without validating that these
- 8.8 High severity
PraisonAIAgents: Improper Neutralization of Special Elements used in an OS Command
PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, he memory hooks executor in praisonaiagents passes a user-controlled command string directly to subprocess.run() with shell=True at src/praisonai-agents/praisonaiagents/memory/hooks.py. No saniti
- 9.6 Critical severity
PraisonAI: Improper Neutralization of Special Elements used in an OS Command
PraisonAI is a multi-agent teams system. Prior to 4.5.121, the execute_command function and workflow shell execution are exposed to user-controlled input via agent workflows, YAML definitions, and LLM-generated tool calls, allowing attackers to inject arbitrar
- 8.8 High severity
PraisonAI: Improper Control of Generation of Code
PraisonAI is a multi-agent teams system. Prior to 4.5.115, the create_agent_centric_tools() function returns tools (like acp_create_file) that process file content using template rendering. When user input from agent.start() is passed directly into these tools
- 9.8 Critical severity
PraisonAI: Deserialization of Untrusted Data
PraisonAI is a multi-agent teams system. Prior to 4.5.115, the AgentService.loadAgentFromFile method uses the js-yaml library to parse YAML files without disabling dangerous tags (such as !!js/function and !!js/undefined). This allows an attacker to craft a ma
- 7.5 High severity
PraisonAI: Exposure of Sensitive Information to an Unauthorized Actor
PraisonAI is a multi-agent teams system. Prior to 4.5.115, the A2U (Agent-to-User) event stream server in PraisonAI exposes all agent activity without authentication. The create_a2u_routes() function registers the following endpoints with NO authentication che
- 9.9 Critical severity
praisonaiagents: Violation of Secure Design Principles
PraisonAI is a multi-agent teams system. Prior to 1.5.115, execute_code() in praisonaiagents.tools.python_tools defaults to sandbox_mode="sandbox", which runs user code in a subprocess wrapped with a restricted __builtins__ dict and an AST-based blocklist. The
- 7.1 High severity
PraisonAI: Improper Limitation of a Pathname to a Restricted Directory
PraisonAI is a multi-agent teams system. Prior to 1.5.113, PraisonAI's recipe registry publish endpoint writes uploaded recipe bundles to a filesystem path derived from the bundle's internal manifest.json before it verifies that the manifest name and version m
- 8.1 High severity
PraisonAI: Improper Limitation of a Pathname to a Restricted Directory
PraisonAI is a multi-agent teams system. Prior to 1.5.113, The PraisonAI templates installation feature is vulnerable to a "Zip Slip" Arbitrary File Write attack. When downloading and extracting template archives from external sources (e.g., GitHub), the appli
- 7.3 High severity
PraisonAI: Improper Limitation of a Pathname to a Restricted Directory
PraisonAI is a multi-agent teams system. Prior to 1.5.113, PraisonAI's recipe registry pull flow extracts attacker-controlled .praison tar archives with tar.extractall() and does not validate archive member paths before extraction. A malicious publisher can up
- 10.0 Critical severity
PraisonAI: Improper Limitation of a Pathname to a Restricted Directory
PraisonAI is a multi-agent teams system. Prior to 1.5.113, the Action Orchestrator feature contains a Path Traversal vulnerability that allows an attacker (or compromised agent) to write to arbitrary files outside of the configured workspace directory. By supp
- 7.5 High severity
PraisonAI: Improper Limitation of a Pathname to a Restricted Directory
PraisonAI is a multi-agent teams system. Prior to 1.5.113, _validate_path() calls os.path.normpath() first, which collapses .. sequences, then checks for '..' in normalized. Since .. is already collapsed, the check always passes. This makes the check completel
- 10.0 Critical severity
PraisonAI: Improper Neutralization of Special Elements used in an OS Command
PraisonAI is a multi-agent teams system. Prior to version 4.5.97, SubprocessSandbox in all modes (BASIC, STRICT, NETWORK_ISOLATED) calls subprocess.run() with shell=True and relies solely on string-pattern matching to block dangerous commands. The blocklist do
- 8.6 High severity
PraisonAI: Server-Side Request Forgery
PraisonAI is a multi-agent teams system. Prior to version 1.5.95, FileTools.download_file() in praisonaiagents validates the destination path but performs no validation on the url parameter, passing it directly to httpx.stream() with follow_redirects=True. An
- 9.1 Critical severity
PraisonAI: Incorrect Authorization
PraisonAI is a multi-agent teams system. Prior to version 4.5.97, OAuthManager.validate_token() returns True for any token not found in its internal store, which is empty by default. Any HTTP request to the MCP server with an arbitrary Bearer token is treated
- 9.1 Critical severity
PraisonAI: Missing Authentication for Critical Functionality
PraisonAI is a multi-agent teams system. Prior to version 4.5.97, the PraisonAI Gateway server accepts WebSocket connections at /ws and serves agent topology at /info with no authentication. Any network client can connect, enumerate registered agents, and send
- 7.5 High severity
PraisonAI: Inefficient Regular Expression Complexity
PraisonAI is a multi-agent teams system. Prior to version 4.5.90, MCPToolIndex.search_tools() compiles a caller-supplied string directly as a Python regular expression with no validation, sanitization, or timeout. A crafted regex causes catastrophic backtracki
- 10.0 Critical severity
PraisonAI: Protection Mechanism Failure
PraisonAI is a multi-agent teams system. Prior to version 1.5.90, execute_code() in praisonai-agents runs attacker-controlled Python inside a three-layer sandbox that can be fully bypassed by passing a str subclass with an overridden startswith() method to the
- 9.8 Critical severity
PraisonAI: Improper Neutralization of Special Elements used in an OS Command
PraisonAI is a multi-agent teams system. Prior to version 1.5.90, run_python() in praisonai constructs a shell command string by interpolating user-controlled code into python3 -c "<code>" and passing it to subprocess.run(..., shell=True). The escaping logic o
- 7.7 High severity
PraisonAI: Server-Side Request Forgery
PraisonAI is a multi-agent teams system. Prior to version 4.5.90, passthrough() and apassthrough() in praisonai accept a caller-controlled api_base parameter that is concatenated with endpoint and passed directly to httpx.Client.request() when the litellm prim
- 9.8 Critical severity
PraisonAI: Improper Neutralization of Special Elements used in an OS Command
PraisonAI is a multi-agent teams system. From version 4.5.15 to before version 4.5.69, the --mcp CLI argument is passed directly to shlex.split() and forwarded through the call chain to anyio.open_process() with no validation, allowlist check, or sanitization
- 9.8 Critical severity
PraisonAI: Improper Neutralization of Special Elements used in an SQL Command
PraisonAI is a multi-agent teams system. Prior to version 4.5.90, the get_all_user_threads function constructs raw SQL queries using f-strings with unescaped thread IDs fetched from the database. An attacker stores a malicious thread ID via update_thread. When