PraisonAI vulnerabilities

A vulnerability in PraisonAI before version 4.6.78 fails to validate file path references in custom command templates, allowing attackers to read files outside the workspace. Attackers can use path traversal sequences like @../outside_secret.txt or absolute paths to exfiltrate process-readable files into model prompts.

In PraisonAI (pip package praisonaiagents) before version 1.6.78, an unsafe dynamic module loading vulnerability exists in AgentFlow._resolve_pydantic_class. When a workflow step uses an output_pydantic reference, the framework imports a sibling tools.py from the workflow file's directory without sandboxing, ignoring PRAISONAI_ALLOW_*_TOOLS environment variables. An attacker controlling a workflow file and its sibling tools.py can execute arbitrary Python code with the workflow runner's privileges.

A vulnerability in PraisonAI before version 4.6.78 allows bypassing the shell command allowlist by using find's built-in actions (-exec, -execdir, -delete). Attackers can execute unauthorized commands, read or delete files without triggering shell metacharacter filters.

A path traversal vulnerability in PraisonAI (praisonaiagents) before version 1.6.78 in the FastContext feature. The FastContextAgent.execute_tool() function does not properly validate absolute paths or canonicalize relative paths, allowing reading, searching, and enumerating files outside the intended workspace directory.

PraisonAI before version 4.6.78 contains a path traversal vulnerability in the ContextGatherer component that fails to validate include paths in .praisoncontext and .praisoninclude files. Attackers can supply absolute paths or parent directory traversal sequences to read arbitrary files outside the workspace and include their contents in the generated context bundle.

PraisonAI before version 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the Jobs API /api/v1/runs endpoint. The webhook_url parameter is validated at request time but re-resolved at connection time, allowing attackers to use DNS rebinding to reach internal services with a blind SSRF attack.

A vulnerability in PraisonAI (praisonaiagents) before version 1.6.78 automatically loads defaults from a project-local .praisonai/config.toml without validating the output.output_file path. An attacker can set this path to an absolute or '..' traversal path, causing agent.start() without an output parameter to overwrite files outside the project root.

A vulnerability in PraisonAI before version 4.6.78 allows bypassing the prompt injection defense mechanism. The defense only blocks threats classified as CRITICAL, requiring three or more detector families to match simultaneously. Attackers can craft single or double-vector prompt injections classified as HIGH threat level, which pass through unblocked to the model.

PraisonAI before version 0.1.7 fails to validate that the project_id in issue create and update request bodies belongs to the URL workspace. An attacker can create issues referencing projects from other workspaces, causing cross-tenant data pollution in project statistics aggregation without workspace constraints.

PraisonAI before 1.5.128 contains a cross-origin agent execution vulnerability in the AGUI endpoint that allows remote attackers to trigger arbitrary agent execution. The POST /agui endpoint lacks authentication and hardcodes Access-Control-Allow-Origin: * headers, enabling attackers to bypass CORS preflight checks.

PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI modules hardcode approval_mode to auto, overriding administrator configuration from PRAISON_APPROVAL_MODE environment variable. Authenticated attackers can instruct the LLM agent to execute arbitrary shell commands.

PraisonAI versions before 1.5.128 cache tool approval decisions based only on tool name, not invocation arguments, allowing subsequent execute_command calls to bypass approval prompts.

In the multi-agent system PraisonAI, versions from 4.5.139 to before 4.6.32 have a vulnerability related to unauthorized file imports. The tool_override.py file lacks safeguards, allowing remote code execution by an attacker.

PraisonAI prior to 4.5.128 allows spawning background servers via stdio using user-supplied command strings in its MCP integration. By default, the entire parent process environment is forwarded to the spawned subprocess, exposing sensitive data such as API keys, authentication tokens, and database credentials.

PraisonAI automatically loads a tools.py file from the current working directory and executes its code without user consent, validation, or sandboxing. Merely placing a malicious tools.py file in the working directory is enough to trigger arbitrary code execution at startup. The issue was fixed in version 4.5.128.

PraisonAI prior to 4.5.128 exposes a GET /api/agents endpoint in the AgentOS platform that returns agent names, roles, and the first 100 characters of agent system instructions to any unauthenticated caller. The FastAPI application has no authentication middleware or API key validation and defaults to CORS allow_origins=["*"] with host 0.0.0.0.

In PraisonAI prior to 4.5.128, the _safe_extractall() function in the recipe registry validates archive members against path traversal but performs no checks on individual member sizes, cumulative extracted size, or member count before calling tar.extractall(). An attacker can publish a malicious bundle with highly compressible data that exhausts the victim's disk.

PraisonAI prior to 4.5.128 has a WSGI-based recipe registry server (server.py) that reads the entire HTTP request body based on client-supplied Content-Length with no upper bound. Combined with authentication disabled by default, any local process can send arbitrarily large POST requests to exhaust memory and cause denial of service. The Starlette server has a 10MB limit, but the WSGI server lacks equivalent protection; fixed in 4.5.128.

In PraisonAI prior to 4.5.128, the Flask API endpoint in src/praisonai/api.py renders agent output as HTML without effective sanitization. The _sanitize_html function relies on the nh3 library, which is not listed as a dependency in pyproject.toml; when nh3 is absent (default installation), the sanitizer is a no-op that returns HTML unchanged.

PraisonAI before version 4.5.115 contains a template injection vulnerability in the create_agent_centric_tools() function. User input passed to agent.start() is processed without proper escaping, allowing template expressions to be executed instead of being treated as literal text.

PraisonAI before version 4.5.115 exposes the A2U (Agent-to-User) event stream server without authentication. The create_a2u_routes() function registers endpoints /a2u/info, /a2u/subscribe, /a2u/events/{stream_name}, /a2u/events/sub/{id}, and /a2u/health with no access controls.

PraisonAI before version 4.5.97 contains a vulnerability in SubprocessSandbox in all modes (BASIC, STRICT, NETWORK_ISOLATED). The subprocess.run() function is called with shell=True and relies solely on string-pattern matching to block dangerous commands. The blocklist does not include sh or bash as standalone executables, allowing trivial sandbox escape in STRICT mode via sh -c '<command>'.

In PraisonAI before version 1.5.95, the FileTools.download_file() function does not validate the URL parameter, passing it directly to httpx.stream() with follow_redirects=True. An attacker controlling the URL can reach any host accessible from the server, including cloud metadata and internal services.

Vulnerability in PraisonAI before version 4.5.90, where MCPToolIndex.search_tools() compiles a caller-supplied string directly as a Python regular expression without validation, sanitization, or timeout. A crafted regex causes catastrophic backtracking in the re engine, blocking the Python thread for hundreds of seconds and causing a complete service outage.

PraisonAI before version 1.5.90 contains a command injection vulnerability in the run_python() function. The function constructs a shell command from user input without proper escaping, allowing arbitrary OS command execution before Python is invoked.

PraisonAI prior to version 4.5.90 has a vulnerability in passthrough() and apassthrough() functions that accept a caller-controlled api_base parameter. This parameter is concatenated with the endpoint and passed to httpx.Client.request() without URL scheme validation, private IP filtering, or domain allowlist, allowing requests to any host reachable from the server. The issue has been fixed in version 4.5.90.