praisonaiagents (PyPI)
Advisories
107
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 4.5.128 or later clears every advisory below that has a fix.
Upgrade commands
pip
pip install --upgrade "praisonaiagents>=4.5.128"poetry
poetry add "praisonaiagents>=4.5.128"uv
uv add "praisonaiagents>=4.5.128"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-gxmw-5f7x-6g22 praisonaiagents vulnerable to arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location |
High EPSS 0.48% |
< 1.6.58 | 1.6.58 |
| GHSA-gxmw-5f7x-6g22 praisonaiagents vulnerable to arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location |
High EPSS 0.48% |
< 1.6.58 | 1.6.58 |
| GHSA-cfxv-8fw8-rwpv praisonaiagents: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool |
Medium EPSS 0.17% |
< 1.6.58 | 1.6.58 |
| GHSA-cfxv-8fw8-rwpv praisonaiagents: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool |
Medium EPSS 0.17% |
< 1.6.58 | 1.6.58 |
| GHSA-x44h-65qv-cw74 praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`) |
High EPSS 0.36% |
< 1.6.58 | 1.6.58 |
| GHSA-x44h-65qv-cw74 praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`) |
High EPSS 0.36% |
< 1.6.58 | 1.6.58 |
| GHSA-7g3p-92qq-8wvh praisonaiagents: AgentServer declares auth_token but never enforces it on any route |
High EPSS 0.49% |
< 1.6.58 | 1.6.58 |
| GHSA-7g3p-92qq-8wvh praisonaiagents: AgentServer declares auth_token but never enforces it on any route |
High EPSS 0.49% |
< 1.6.58 | 1.6.58 |
| GHSA-5r34-2g38-6569 praisonaiagents web_crawl vulnerable to SSRF via redirect-following |
High EPSS 0.51% |
< 1.6.58 | 1.6.58 |
| GHSA-5r34-2g38-6569 praisonaiagents web_crawl vulnerable to SSRF via redirect-following |
High EPSS 0.51% |
< 1.6.58 | 1.6.58 |
| GHSA-vg6p-v9vm-6fgj praisonaiagents vulnerable to SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap) |
High EPSS 0.24% |
< 1.6.58 | 1.6.58 |
| GHSA-vg6p-v9vm-6fgj praisonaiagents vulnerable to SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap) |
High EPSS 0.24% |
< 1.6.58 | 1.6.58 |
| GHSA-8hjw-25cg-g52h praisonaiagents has a `web_crawl` SSRF protection bypass via unchecked redirect targets |
High EPSS 0.47% |
>= 1.5.128, < 1.6.58 | 1.6.58 |
| GHSA-8hjw-25cg-g52h praisonaiagents has a `web_crawl` SSRF protection bypass via unchecked redirect targets |
High EPSS 0.47% |
>= 1.5.128, < 1.6.58 | 1.6.58 |
| GHSA-hxmv-c4g6-5fqc PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code |
High EPSS 0.22% |
>= 0.12.12, < 1.6.58 | 1.6.58 |
| GHSA-hxmv-c4g6-5fqc PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code |
High EPSS 0.22% |
>= 0.12.12, < 1.6.58 | 1.6.58 |
| GHSA-q359-rmv4-56fg Duplicate Advisory: PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification Withdrawn |
High | <= 1.6.77 | No fix yet |
| GHSA-f352-4x87-wmjh Duplicate Advisory: PraisonAI: SkillTools Executes Scripts Without Path Containment Validation Withdrawn |
High | <= 1.6.77 | No fix yet |
| GHSA-92x2-g374-gcvx Duplicate Advisory: PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure Withdrawn |
High | <= 1.6.77 | No fix yet |
| GHSA-r3xw-gcpr-rf26 Duplicate Advisory: PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments Withdrawn |
Medium | <= 1.6.77 | No fix yet |
| GHSA-m6wp-h223-4c8g PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification |
High EPSS 0.34% |
< 1.6.78 | 1.6.78 |
| GHSA-m6wp-h223-4c8g PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification |
High EPSS 0.34% |
< 1.6.78 | 1.6.78 |
| GHSA-c44f-37qr-gw3f PraisonAI: SkillTools Executes Scripts Without Path Containment Validation |
High EPSS 0.64% |
< 1.6.78 | 1.6.78 |
| GHSA-c44f-37qr-gw3f PraisonAI: SkillTools Executes Scripts Without Path Containment Validation |
High EPSS 0.64% |
< 1.6.78 | 1.6.78 |
| GHSA-qg25-6gc4-48mg PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure |
High EPSS 0.25% |
< 1.6.78 | 1.6.78 |
| GHSA-qg25-6gc4-48mg PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure |
High EPSS 0.25% |
< 1.6.78 | 1.6.78 |
| GHSA-29r9-67vg-qj56 PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments |
Medium EPSS 0.34% |
< 1.6.78 | 1.6.78 |
| GHSA-29r9-67vg-qj56 PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments |
Medium EPSS 0.34% |
< 1.6.78 | 1.6.78 |
| GHSA-rc3q-9pxg-3jhr Duplicate Advisory: PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass Withdrawn |
High | <= 1.6.77 | No fix yet |
| GHSA-2xv2-w8cq-5gxw PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets |
Critical EPSS 15.24% |
< 1.6.78 | 1.6.78 |
| GHSA-2xv2-w8cq-5gxw PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets |
Critical EPSS 15.24% |
< 1.6.78 | 1.6.78 |
| GHSA-6g59-gm2v-qhvq PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass |
High EPSS 0.27% |
< 1.6.78 | 1.6.78 |
| GHSA-6g59-gm2v-qhvq PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass |
High EPSS 0.27% |
< 1.6.78 | 1.6.78 |
| GHSA-c6pq-cprj-62fw Duplicate Advisory: PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow Withdrawn |
High | <= 1.6.77 | No fix yet |
| GHSA-3f4v-mp44-x4x2 Duplicate Advisory: PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace Withdrawn |
Medium | <= 1.6.77 | No fix yet |
| GHSA-rrqj-82cc-g6h4 Duplicate Advisory: PraisonAI: Project config can auto-save agent output outside the project root Withdrawn |
Medium | <= 1.6.77 | No fix yet |
| GHSA-4gfv-wg42-7jw5 PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow |
High EPSS 0.20% |
< 1.6.78 | 1.6.78 |
| GHSA-4gfv-wg42-7jw5 PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow |
High EPSS 0.20% |
< 1.6.78 | 1.6.78 |
| GHSA-4xxv-6wmf-xf45 PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace |
Medium EPSS 0.34% |
< 1.6.78 | 1.6.78 |
| GHSA-4xxv-6wmf-xf45 PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace |
Medium EPSS 0.34% |
< 1.6.78 | 1.6.78 |
| GHSA-qjw5-xwrp-xwpq PraisonAI: Project config can auto-save agent output outside the project root |
Medium EPSS 0.20% |
< 1.6.78 | 1.6.78 |
| GHSA-qjw5-xwrp-xwpq PraisonAI: Project config can auto-save agent output outside the project root |
Medium EPSS 0.20% |
< 1.6.78 | 1.6.78 |
| GHSA-4pcv-mg8v-vrgf PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter |
High EPSS 0.27% |
< 1.6.61 | 1.6.61 |
| GHSA-4pcv-mg8v-vrgf PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter |
High EPSS 0.27% |
< 1.6.61 | 1.6.61 |
| GHSA-c969-5x3p-vq3v PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters |
High EPSS 0.46% |
< 1.6.59 | 1.6.59 |
| GHSA-c969-5x3p-vq3v PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters |
High EPSS 0.46% |
< 1.6.59 | 1.6.59 |
| GHSA-x8cv-xmq7-p8xp PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints |
Critical EPSS 0.41% |
< 1.6.59 | 1.6.59 |
| GHSA-x8cv-xmq7-p8xp PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints |
Critical EPSS 0.41% |
< 1.6.59 | 1.6.59 |
| GHSA-2rcg-mm5h-xchx PraisonAI: Arbitrary File Read via `@file:` Mention Path Traversal |
High EPSS 0.53% |
< 1.6.59 | 1.6.59 |
| GHSA-2rcg-mm5h-xchx PraisonAI: Arbitrary File Read via `@file:` Mention Path Traversal |
High EPSS 0.53% |
< 1.6.59 | 1.6.59 |
| GHSA-vxgj-xg5c-p4h7 praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS |
High EPSS 0.38% |
< 1.6.59 | 1.6.59 |
| GHSA-vxgj-xg5c-p4h7 praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS |
High EPSS 0.38% |
< 1.6.59 | 1.6.59 |
| GHSA-4869-x4pr-q22x PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass |
Critical EPSS 0.60% |
< 1.6.59 | 1.6.59 |
| GHSA-4869-x4pr-q22x PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass |
Critical EPSS 0.60% |
< 1.6.59 | 1.6.59 |
| GHSA-x227-pf99-vffg PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in |
Critical EPSS 0.90% |
< 1.6.59 | 1.6.59 |
| GHSA-x227-pf99-vffg PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in |
Critical EPSS 0.90% |
< 1.6.59 | 1.6.59 |
| GHSA-pv2j-rghr-v5r9 PraisonAI: execute_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunder |
Medium EPSS 0.56% |
< 1.6.59 | 1.6.59 |
| GHSA-pv2j-rghr-v5r9 PraisonAI: execute_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunder |
Medium EPSS 0.56% |
< 1.6.59 | 1.6.59 |
| GHSA-6h9p-93hq-q7h6 PraisonAI: SpiderTools redirect-target SSRF protection bypass |
Medium EPSS 0.43% |
< 1.6.59 | 1.6.59 |
| GHSA-6h9p-93hq-q7h6 PraisonAI: SpiderTools redirect-target SSRF protection bypass |
Medium EPSS 0.43% |
< 1.6.59 | 1.6.59 |
| GHSA-vmf9-xx9w-86wx PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools |
High EPSS 0.22% |
>= 0.6.0, < 1.6.59 | 1.6.59 |
| GHSA-vmf9-xx9w-86wx PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools |
High EPSS 0.22% |
>= 0.6.0, < 1.6.59 | 1.6.59 |
| GHSA-35w5-pcw4-jx94 PraisonAI: Unauthenticated Event Injection via SSE `/publish` Endpoint |
Medium EPSS 0.25% |
< 1.6.59 | 1.6.59 |
| GHSA-35w5-pcw4-jx94 PraisonAI: Unauthenticated Event Injection via SSE `/publish` Endpoint |
Medium EPSS 0.25% |
< 1.6.59 | 1.6.59 |
| GHSA-4mr5-g6f9-cfrh PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode) |
Critical EPSS 0.88% |
< 1.6.40 | 1.6.40 |
| GHSA-4mr5-g6f9-cfrh PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode) |
Critical EPSS 0.88% |
< 1.6.40 | 1.6.40 |
| GHSA-5cxw-77wg-jrf3 PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context |
Medium EPSS 0.18% |
< 1.6.40 | 1.6.40 |
| GHSA-5cxw-77wg-jrf3 PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context |
Medium EPSS 0.18% |
< 1.6.40 | 1.6.40 |
| GHSA-5c6w-wwfq-7qqm PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings |
Medium EPSS 0.18% |
< 1.6.40 | 1.6.40 |
| GHSA-5c6w-wwfq-7qqm PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings |
Medium EPSS 0.18% |
< 1.6.40 | 1.6.40 |
| GHSA-gmjg-hv98-qggq PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute |
High EPSS 0.36% |
< 1.6.37 | 1.6.37 |
| GHSA-gmjg-hv98-qggq PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute |
High EPSS 0.36% |
< 1.6.37 | 1.6.37 |
| GHSA-q9pw-vmhh-384g PraisonAI has an SSRF bypass |
Critical EPSS 0.38% |
< 1.6.32 | 1.6.32 |
| GHSA-q9pw-vmhh-384g PraisonAI has an SSRF bypass |
Critical EPSS 0.38% |
< 1.6.32 | 1.6.32 |
| GHSA-rg3h-x3jw-7jm5 PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315) |
High EPSS 0.35% |
< 1.6.8 | 1.6.8 |
| GHSA-rg3h-x3jw-7jm5 PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315) |
High EPSS 0.35% |
< 1.6.8 | 1.6.8 |
| GHSA-8x8f-54wf-vv92 PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions |
Critical EPSS 0.42% |
< 1.5.140 | 1.5.140 |
| GHSA-8x8f-54wf-vv92 PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions |
Critical EPSS 0.42% |
< 1.5.140 | 1.5.140 |
| GHSA-vc46-vw85-3wvm PraisonAI has critical RCE via `type: job` workflow YAML |
Critical EPSS 0.61% |
< 1.5.140 | 1.5.140 |
| GHSA-vc46-vw85-3wvm PraisonAI has critical RCE via `type: job` workflow YAML |
Critical EPSS 0.61% |
< 1.5.140 | 1.5.140 |
| GHSA-g985-wjh9-qxxc PraisonAI Vulnerable to RCE via Automatic tools.py Import |
High EPSS 0.25% |
< 1.5.140 | 1.5.140 |
| GHSA-g985-wjh9-qxxc PraisonAI Vulnerable to RCE via Automatic tools.py Import |
High EPSS 0.25% |
< 1.5.140 | 1.5.140 |
| GHSA-ffp3-3562-8cv3 PraisonAI: Coarse-Grained Tool Approval Cache Bypasses Per-Invocation Consent for Shell Commands |
Medium EPSS 0.18% |
< 4.5.128 | 4.5.128 |
| GHSA-ffp3-3562-8cv3 PraisonAI: Coarse-Grained Tool Approval Cache Bypasses Per-Invocation Consent for Shell Commands |
Medium EPSS 0.18% |
< 4.5.128 | 4.5.128 |
| GHSA-x462-jjpc-q4q4 PraisonAI: Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI Endpoint |
High | < 4.5.128 | 4.5.128 |
| GHSA-qq9r-63f6-v542 PraisonAIAgents: SSRF via unvalidated URL in `web_crawl` httpx fallback |
Medium EPSS 0.46% |
>= 0.13.23, < 1.5.128 | 1.5.128 |
| GHSA-qq9r-63f6-v542 PraisonAIAgents: SSRF via unvalidated URL in `web_crawl` httpx fallback |
Medium EPSS 0.46% |
>= 0.13.23, < 1.5.128 | 1.5.128 |
| GHSA-v8g7-9q6v-p3x8 PraisonAIAgents: Environment Variable Secret Exfiltration via os.path.expandvars() Bypassing shell=False in Shell Tool |
Medium EPSS 0.27% |
< 1.5.128 | 1.5.128 |
| GHSA-v8g7-9q6v-p3x8 PraisonAIAgents: Environment Variable Secret Exfiltration via os.path.expandvars() Bypassing shell=False in Shell Tool |
Medium EPSS 0.27% |
< 1.5.128 | 1.5.128 |
| GHSA-7j2f-xc8p-fjmq PraisonAIAgents: Path Traversal via Unvalidated Glob Pattern in list_files Bypasses Workspace Boundary |
Medium EPSS 0.40% |
< 1.5.128 | 1.5.128 |
| GHSA-7j2f-xc8p-fjmq PraisonAIAgents: Path Traversal via Unvalidated Glob Pattern in list_files Bypasses Workspace Boundary |
Medium EPSS 0.40% |
< 1.5.128 | 1.5.128 |
| GHSA-8f4v-xfm9-3244 PraisonAIAgents has SSRF and Local File Read via Unvalidated URLs in web_crawl Tool |
Medium EPSS 0.27% |
< 1.5.128 | 1.5.128 |
| GHSA-8f4v-xfm9-3244 PraisonAIAgents has SSRF and Local File Read via Unvalidated URLs in web_crawl Tool |
Medium EPSS 0.27% |
< 1.5.128 | 1.5.128 |
| GHSA-grrg-5cg9-58pf PraisonAIAgents: Arbitrary File Read via read_skill_file Missing Workspace Boundary and Approval Gate |
High EPSS 0.34% |
< 1.5.128 | 1.5.128 |
| GHSA-grrg-5cg9-58pf PraisonAIAgents: Arbitrary File Read via read_skill_file Missing Workspace Boundary and Approval Gate |
High EPSS 0.34% |
< 1.5.128 | 1.5.128 |
| GHSA-v7px-3835-7gjx PraisonAIAgents has an OS Command Injection via shell=True in Memory Hooks Executor (memory/hooks.py) |
High EPSS 0.23% |
< 1.5.128 | 1.5.128 |
| GHSA-v7px-3835-7gjx PraisonAIAgents has an OS Command Injection via shell=True in Memory Hooks Executor (memory/hooks.py) |
High EPSS 0.23% |
< 1.5.128 | 1.5.128 |
| GHSA-766v-q9x3-g744 PraisonAI has Memory State Leakage and Path Traversal in MultiAgent Context Handling |
High EPSS 0.92% |
< 1.5.115 | 1.5.115 |
| GHSA-766v-q9x3-g744 PraisonAI has Memory State Leakage and Path Traversal in MultiAgent Context Handling |
High EPSS 0.92% |
< 1.5.115 | 1.5.115 |
| GHSA-qf73-2hrx-xprp PraisonAI has sandbox escape via exception frame traversal in `execute_code` (subprocess mode) |
Critical EPSS 0.48% |
< 1.5.115 | 1.5.115 |
| GHSA-qf73-2hrx-xprp PraisonAI has sandbox escape via exception frame traversal in `execute_code` (subprocess mode) |
Critical EPSS 0.48% |
< 1.5.115 | 1.5.115 |
| GHSA-44c2-3rw4-5gvh PraisonAI Has SSRF in FileTools.download_file() via Unvalidated URL |
High EPSS 0.41% |
< 1.5.95 | 1.5.95 |
| GHSA-44c2-3rw4-5gvh PraisonAI Has SSRF in FileTools.download_file() via Unvalidated URL |
High EPSS 0.41% |
< 1.5.95 | 1.5.95 |
| GHSA-w37c-qqfp-c67f PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution |
Critical EPSS 0.57% |
< 1.5.90 | 1.5.90 |
| GHSA-w37c-qqfp-c67f PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution |
Critical EPSS 0.57% |
< 1.5.90 | 1.5.90 |
| GHSA-6vh2-h83c-9294 PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code |
Critical EPSS 13.40% |
< 1.5.90 | 1.5.90 |
| GHSA-6vh2-h83c-9294 PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code |
Critical EPSS 13.40% |
< 1.5.90 | 1.5.90 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor