Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
GHSA-gmjg-hv98-qggq
  • PyPI/praisonai
  • PyPI/praisonaiagents
 PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute 11 May
  • Fix available
  • Severity - 8.6 (High)
GHSA-q9pw-vmhh-384g
  • PyPI/praisonaiagents
 PraisonAI has an SSRF bypass 06 May
  • Fix available
  • Severity - 7.7 (High)
GHSA-rg3h-x3jw-7jm5
  • PyPI/praisonai
  • PyPI/praisonaiagents
 PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315) 17 Apr
  • Fix available
  • Severity - 8.1 (High)
GHSA-8x8f-54wf-vv92
  • PyPI/praisonai
  • PyPI/praisonaiagents
 PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions 10 Apr
  • Fix available
  • Severity - 9.1 (Critical)
GHSA-vc46-vw85-3wvm
  • PyPI/praisonai
  • PyPI/praisonaiagents
 PraisonAI has critical RCE via `type: job` workflow YAML 10 Apr
  • Fix available
  • Severity - 9.8 (Critical)
GHSA-g985-wjh9-qxxc
  • PyPI/praisonai
  • PyPI/praisonaiagents
 PraisonAI Vulnerable to RCE via Automatic tools.py Import 10 Apr
  • Fix available
  • Severity - 8.4 (High)
GHSA-ffp3-3562-8cv3
  • PyPI/praisonaiagents
 PraisonAI: Coarse-Grained Tool Approval Cache Bypasses Per-Invocation Consent for Shell Commands 10 Apr
  • Fix available
  • Severity - 5.5 (Medium)
GHSA-qq9r-63f6-v542
  • PyPI/praisonaiagents
 PraisonAIAgents: SSRF via unvalidated URL in `web_crawl` httpx fallback 10 Apr
  • Fix available
  • Severity - 7.1 (High)
GHSA-x462-jjpc-q4q4
  • PyPI/praisonaiagents
 PraisonAI: Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI Endpoint 10 Apr
  • Fix available
  • Severity - 8.1 (High)
GHSA-7j2f-xc8p-fjmq
  • PyPI/praisonaiagents
 PraisonAIAgents: Path Traversal via Unvalidated Glob Pattern in list_files Bypasses Workspace Boundary 10 Apr
  • Fix available
  • Severity - 5.3 (Medium)
GHSA-v8g7-9q6v-p3x8
  • PyPI/praisonaiagents
 PraisonAIAgents: Environment Variable Secret Exfiltration via os.path.expandvars() Bypassing shell=False in Shell Tool 10 Apr
  • Fix available
  • Severity - 7.4 (High)
GHSA-8f4v-xfm9-3244
  • PyPI/praisonaiagents
 PraisonAIAgents has SSRF and Local File Read via Unvalidated URLs in web_crawl Tool 10 Apr
  • Fix available
  • Severity - 7.7 (High)
GHSA-grrg-5cg9-58pf
  • PyPI/praisonaiagents
 PraisonAIAgents: Arbitrary File Read via read_skill_file Missing Workspace Boundary and Approval Gate 10 Apr
  • Fix available
  • Severity - 6.2 (Medium)
GHSA-v7px-3835-7gjx
  • PyPI/praisonaiagents
 PraisonAIAgents has an OS Command Injection via shell=True in Memory Hooks Executor (memory/hooks.py) 10 Apr
  • Fix available
  • Severity - 9.3 (Critical)
GHSA-766v-q9x3-g744
  • PyPI/praisonaiagents
 PraisonAI has Memory State Leakage and Path Traversal in MultiAgent Context Handling 08 Apr
  • Fix available
  • Severity - 6.5 (Medium)
GHSA-qf73-2hrx-xprp
  • PyPI/praisonaiagents
 PraisonAI has sandbox escape via exception frame traversal in `execute_code` (subprocess mode) 08 Apr
  • Fix available
  • Severity - 9.9 (Critical)
Load more...(1 page left)