Dinhvaren

**Name of the Vulnerable Software and Affected Versions** PraisonAI versions prior to 4.6.78 **Description** The MCP HTTP-stream transport is exposed without authentication by default because the CLI `--api-key` option defaults to `None`, and the server only enforces Authorization/Bearer checks when an API key is configured. An unauthenticated client can initialize a session, enumerate available tools via the `tools/list` endpoint, and invoke tools via the `tools/call` endpoint. Furthermore, the dispatcher forwards tool-call arguments to handlers without validating them against the `inputSchema`. While the server binds to 127.0.0.1 by default, remote exploitation is possible if the operator binds the server to a network-accessible address using the `--host` parameter. **Recommendations** Update PraisonAI to version 4.6.78 or later. As a temporary mitigation, ensure the server is not bound to a network-accessible address like `0.0.0.0` and always configure a valid API key using the `--api-key` option.

PraisonAI before 1.6.78 contains a server-side request forgery vulnerability in the web crawl tool that validates hostnames at check time but re-resolves them at connection time without IP pinning. Attackers can use DNS rebinding to bypass SSRF protection and retrieve internal HTTP response bodies from private or loopback services.

**Name of the Vulnerable Software and Affected Versions** PraisonAI versions prior to 1.7.3 **Description** The software has an insecure default configuration that binds to all network interfaces, lacks API key requirements, and uses wildcard CORS (Cross-Origin Resource Sharing), which allows resources to be requested from any domain. Unauthenticated attackers can access the 'GET /api/agents' endpoint to read agent instructions and system prompts, or use the 'POST /api/chat' endpoint to invoke agents. **Recommendations** Update PraisonAI to version 1.7.3 or later.

**Name of the Vulnerable Software and Affected Versions** PraisonAI AgentMail versions prior to 4.6.78 **Description** The software lacks signature verification when operating in webhook mode. This allows unauthenticated attackers to inject messages with spoofed sender addresses by sending crafted `message.received` events to the webhook endpoint. This action enables the injection of arbitrary content into the agent and can trigger replies to addresses controlled by the attacker, effectively bypassing sender allow and block lists. **Recommendations** Update to version 4.6.78 or later.

**Name of the Vulnerable Software and Affected Versions** PraisonAI versions prior to 1.6.78 **Description** A server-side request forgery (SSRF) issue exists in the Crawl4AI/Chromium backend. This flaw allows attackers to bypass SSRF validation by utilizing DNS rebinding and HTTP redirects. By crafting specific URLs that resolve to internal services after the initial validation, an attacker can force the headless browser to follow redirects and read internal responses, which may include sensitive canary values. **Recommendations** Update PraisonAI to version 1.6.78 or later.

**Name of the Vulnerable Software and Affected Versions** PraisonAI versions prior to 4.6.78 **Description** An unauthenticated server-side request forgery (SSRF) exists in the Jobs API endpoint '/api/v1/runs'. The issue occurs because the `webhook url` parameter is validated during the initial request but re-resolved during the connection phase. This allows attackers to employ DNS rebinding—a technique used to bypass security filters by changing the IP address associated with a domain name between the time of validation and the time of use—to conduct blind SSRF attacks against internal services. **Recommendations** Update PraisonAI to version 4.6.78 or later. As a temporary mitigation, restrict access to the '/api/v1/runs' endpoint or avoid using the `webhook url` parameter until the update is applied.