Riodrwn

#2828of 56,330
94.2Total CVSS
Vulnerabilities · 14
Medium
8
High
6
PT-2026-81348
8.6
2026-08-25
Praisonai · Praisonai · CVE-2026-55539
**Name of the Vulnerable Software and Affected Versions** PraisonAI versions prior to 4.6.58 **Description** The Jobs API in PraisonAI lacks authentication middleware, router-level dependencies, and per-route authorization checks. This allows any caller who can reach the jobs server to submit agent jobs using the operator's configured LLM credentials, list all jobs in the shared store, read results of other jobs, cancel running jobs, and delete terminal jobs. The issue occurs because the `create app()` function in `server.py` mounts the jobs router without any authentication mechanism. **API Endpoints:** - `/api/v1/runs` (used for submitting and listing jobs) - `/api/v1/runs/{job id}` (used for getting job status and deleting jobs) - `/api/v1/runs/{job id}/result` (used for reading job results) - `/api/v1/runs/{job id}/cancel` (used for cancelling jobs) - `/api/v1/runs/{job id}/stream` (used for streaming job output) **Vulnerable Parameters or Variables:** - `job id`: Used to identify specific jobs for retrieval, cancellation, or deletion. **Function Names:** - `create app()`: Fails to implement authentication when mounting the jobs router. **Recommendations** Update PraisonAI to version 4.6.58 or later. As a temporary mitigation, restrict access to the `/api/v1/runs` endpoint by ensuring the server is bound only to `127.0.0.1` and is not exposed via public interfaces, container publishing, reverse proxies, or tunnels.
PT-2026-81329
7.1
2026-08-25
Praisonai · Praisonai · CVE-2026-55540
**Name of the Vulnerable Software and Affected Versions** PraisonAI versions prior to 4.6.58 **Description** PraisonAI contains path traversal flaws in its `praisonai.code` tool wrappers, which are intended to treat the `workspace` setting as a security boundary. The boundary is enforced inconsistently and unsoundly across several tools: 1. The `is path within directory()` function uses `os.path.abspath()` instead of `os.path.realpath()`. This allows a symlink located inside the workspace that points to a target outside the workspace to bypass security checks, enabling the `read file`, `write file`, `apply diff`, and `search replace` tools to access external files. 2. The `list files()` function fails to call the containment helper entirely, allowing absolute paths or `../` sequences to escape the workspace. 3. The `execute command()` and `code execute command()` functions do not validate the `cwd` (current working directory) parameter, allowing commands to be executed from directories outside the configured workspace. An attacker capable of influencing an agent—via untrusted prompts or indirect prompt injection—can read, overwrite, list, and execute files and binaries outside the workspace, limited only by the filesystem permissions of the process user. **Recommendations** Update PraisonAI to version 4.6.58. As a temporary mitigation, restrict the use of the `read file`, `write file`, `apply diff`, `search replace`, `list files`, and `execute command` tools when processing untrusted input.