praisonai-platform (PyPI)
Advisories
49
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 0.1.9 or later clears every advisory below that has a fix.
Upgrade commands
pip
pip install --upgrade "praisonai-platform>=0.1.9"poetry
poetry add "praisonai-platform>=0.1.9"uv
uv add "praisonai-platform>=0.1.9"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-vp55-5c2v-3597 Duplicate Advisory: PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization Withdrawn |
Medium | <= 0.1.8 | No fix yet |
| GHSA-xxgv-vgvj-qvxh PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization |
High EPSS 0.26% |
< 0.1.9 | 0.1.9 |
| GHSA-xxgv-vgvj-qvxh PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization |
High EPSS 0.26% |
< 0.1.9 | 0.1.9 |
| GHSA-f996-h3c6-gcwg Duplicate Advisory: PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass Withdrawn |
High | <= 0.1.8 | No fix yet |
| GHSA-c78w-2q4r-68r7 PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass |
High EPSS 0.31% |
< 0.1.9 | 0.1.9 |
| GHSA-c78w-2q4r-68r7 PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass |
High EPSS 0.31% |
< 0.1.9 | 0.1.9 |
| GHSA-mxmx-rh57-jx58 PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues |
High EPSS 0.29% |
< 0.1.9 | 0.1.9 |
| GHSA-mxmx-rh57-jx58 PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues |
High EPSS 0.29% |
< 0.1.9 | 0.1.9 |
| GHSA-2fjj-qqg8-fg7x praisonai-platform: Authorization Bypass Through User-Controlled Key |
Medium EPSS 0.26% |
< 0.1.8 | 0.1.8 |
| GHSA-cwj8-7gp2-ggcw praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery |
Critical EPSS 0.77% |
< 0.1.6 | 0.1.6 |
| GHSA-cwj8-7gp2-ggcw praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery |
Critical EPSS 0.77% |
< 0.1.6 | 0.1.6 |
| GHSA-f38v-77qj-h4jq praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard) |
Critical EPSS 0.64% |
< 0.1.6 | 0.1.6 |
| GHSA-f38v-77qj-h4jq praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard) |
Critical EPSS 0.64% |
< 0.1.6 | 0.1.6 |
| GHSA-rh39-9c67-59mh PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API |
High EPSS 0.33% |
>= 0.1.4, < 0.1.6 | 0.1.6 |
| GHSA-rh39-9c67-59mh PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API |
High EPSS 0.33% |
>= 0.1.4, < 0.1.6 | 0.1.6 |
| GHSA-7p8g-6c6g-h9w7 praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR |
High EPSS 0.34% |
< 0.1.4 | 0.1.4 |
| GHSA-7p8g-6c6g-h9w7 praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR |
High EPSS 0.34% |
< 0.1.4 | 0.1.4 |
| GHSA-g8rr-7rj2-f627 praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id} |
High EPSS 0.53% |
< 0.1.4 | 0.1.4 |
| GHSA-g8rr-7rj2-f627 praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id} |
High EPSS 0.53% |
< 0.1.4 | 0.1.4 |
| GHSA-xwq8-frcg-77q8 praisonai-platform: Issue endpoints accept any issue_id without workspace ownership check, cross-workspace read/update/delete IDOR |
High EPSS 0.39% |
< 0.1.4 | 0.1.4 |
| GHSA-xwq8-frcg-77q8 praisonai-platform: Issue endpoints accept any issue_id without workspace ownership check, cross-workspace read/update/delete IDOR |
High EPSS 0.39% |
< 0.1.4 | 0.1.4 |
| GHSA-8g2p-pqm3-fcfh praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members |
Critical EPSS 0.26% |
< 0.1.4 | 0.1.4 |
| GHSA-8g2p-pqm3-fcfh praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members |
Critical EPSS 0.26% |
< 0.1.4 | 0.1.4 |
| GHSA-rcmc-q9rj-4wmq praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id} |
Medium EPSS 0.34% |
< 0.1.4 | 0.1.4 |
| GHSA-rcmc-q9rj-4wmq praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id} |
Medium EPSS 0.34% |
< 0.1.4 | 0.1.4 |
| GHSA-cp4f-5m9r-5jc2 praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR |
High EPSS 0.36% |
< 0.1.4 | 0.1.4 |
| GHSA-cp4f-5m9r-5jc2 praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR |
High EPSS 0.36% |
< 0.1.4 | 0.1.4 |
| GHSA-943m-6wx2-rc2j praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR |
High EPSS 0.41% |
< 0.1.4 | 0.1.4 |
| GHSA-943m-6wx2-rc2j praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR |
High EPSS 0.41% |
< 0.1.4 | 0.1.4 |
| GHSA-c2m8-4gcg-v22g praisonai-platform: Any workspace member can promote themselves or others to owner via PATCH /workspaces/{id}/members/{user_id} |
Critical EPSS 0.26% |
< 0.1.4 | 0.1.4 |
| GHSA-c2m8-4gcg-v22g praisonai-platform: Any workspace member can promote themselves or others to owner via PATCH /workspaces/{id}/members/{user_id} |
Critical EPSS 0.26% |
< 0.1.4 | 0.1.4 |
| GHSA-w388-2392-px73 praisonai-platform: Missing authorization on member removal enables full workspace takeover by any user regardless of role |
High EPSS 0.34% |
< 0.1.4 | 0.1.4 |
| GHSA-w388-2392-px73 praisonai-platform: Missing authorization on member removal enables full workspace takeover by any user regardless of role |
High EPSS 0.34% |
< 0.1.4 | 0.1.4 |
| GHSA-5jx9-w35f-vp65 praisonai-platform: Label endpoints' unchecked label_id/issue_id enable cross-workspace label IDOR (edit, delete, link) |
High EPSS 0.38% |
< 0.1.4 | 0.1.4 |
| GHSA-5jx9-w35f-vp65 praisonai-platform: Label endpoints' unchecked label_id/issue_id enable cross-workspace label IDOR (edit, delete, link) |
High EPSS 0.38% |
< 0.1.4 | 0.1.4 |
| GHSA-4x6r-9v57-3gqw praisonai-platform: IDOR in dependency endpoints allows cross-workspace issue linking, reading, and deletion due to missing ownership checks |
High EPSS 0.41% |
< 0.1.4 | 0.1.4 |
| GHSA-4x6r-9v57-3gqw praisonai-platform: IDOR in dependency endpoints allows cross-workspace issue linking, reading, and deletion due to missing ownership checks |
High EPSS 0.41% |
< 0.1.4 | 0.1.4 |
| GHSA-3qg8-5g3r-79v5 praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unset |
Critical EPSS 0.45% |
< 0.1.4 | 0.1.4 |
| GHSA-3qg8-5g3r-79v5 praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unset |
Critical EPSS 0.45% |
< 0.1.4 | 0.1.4 |
| GHSA-h37g-4h4p-9x97 PraisonAI Platform: Missing role checks let any workspace member become owner and control workspace membership |
High EPSS 0.36% |
< 0.1.4 | 0.1.4 |
| GHSA-h37g-4h4p-9x97 PraisonAI Platform: Missing role checks let any workspace member become owner and control workspace membership |
High EPSS 0.36% |
< 0.1.4 | 0.1.4 |
| GHSA-6h6v-6m7w-7vxx PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID |
High EPSS 0.36% |
< 0.1.4 | 0.1.4 |
| GHSA-6h6v-6m7w-7vxx PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID |
High EPSS 0.36% |
< 0.1.4 | 0.1.4 |
| GHSA-h8q5-cp56-rr65 PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation |
Critical EPSS 0.30% |
< 0.1.4 | 0.1.4 |
| GHSA-h8q5-cp56-rr65 PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation |
Critical EPSS 0.30% |
< 0.1.4 | 0.1.4 |
| GHSA-27p4-pjqv-whgj praisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership |
Medium EPSS 0.29% |
< 0.1.4 | 0.1.4 |
| GHSA-27p4-pjqv-whgj praisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership |
Medium EPSS 0.29% |
< 0.1.4 | 0.1.4 |
| GHSA-gv23-xrm3-8c62 PraisonAI has Cross-Workspace IDOR and Privilege Escalation via Platform API |
High EPSS 0.44% |
< 0.1.4 | 0.1.4 |
| GHSA-gv23-xrm3-8c62 PraisonAI has Cross-Workspace IDOR and Privilege Escalation via Platform API |
High EPSS 0.44% |
< 0.1.4 | 0.1.4 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor