Vulnerability feed

Executive summary

A flaw in the PraisonAI multi-agent system's A2U event server lets anyone who can reach the server subscribe to agent event streams without credentials when it is started with the documented praisonai serve a2u command and no A2U_AUTH_TOKEN is set. The advisory rates it High with a suggested CVSS v3.1 score of 7.5, and states that the prior fix in GHSA-f292-66h9-fpmf does not cover this command path. The advisory recommends secure-by-default authentication for the A2U command, token support on the command line, and refusing external binds without authentication, and it notes that the affected range should not be marked as fixed.

Technical summary

This is a missing authentication issue (CWE-306) with related sensitive information exposure (CWE-200) in the PraisonAI A2U server, affecting pip package praisonai versions >= 4.5.115, <= 4.6.58 as stated in the advisory, with patched versions listed as >= 4.6.61. The attack vector is network access to the A2U server, which the advisory says is started with praisonai serve a2u --host 0.0.0.0 --port 8002, with low complexity and no privileges or user interaction required. Authentication is only enforced if the A2U_AUTH_TOKEN environment variable is set before startup; otherwise the subscribe, event stream, info, and health routes accept unauthenticated requests, and the CLI does not offer --api-key or generate a token. The advisory's proof-of-concept output shows HTTP 200 responses without credentials when no token is configured and 401 when a token is configured. No workaround beyond setting A2U_AUTH_TOKEN is described in the advisory as an official fix, and whether a vendor-issued patch resolves this is not stated. Detection guidance beyond the proof-of-concept is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-jxcw-qp4h-6jfq

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affects

MervinPraisonMervinPraison PraisonAI

Executive summary

PraisonAI, a multi-agent teams system, has a flaw in its Sandlock sandbox that can let code run outside its intended isolation when the kernel feature Landlock is unavailable. The advisory rates it High, with a suggested CVSS 3.1 score of 8.8 and a suggested severity of High. The advisory states that no fixed version is known at submission time, and its suggested fix is to make the sandbox fail closed instead of falling back to unrestricted execution.

Technical summary

The flaw is a protection mechanism failure (CWE-693) in praisonai.sandbox.SandlockSandbox. When the optional sandlock module reports that Landlock is unavailable, execute() and run_command() silently fall back to SubprocessSandbox, which does not enforce the configured filesystem allowlist or network=False setting. The advisory's proof of concept showed code reading a file outside the allowed path and connecting to a localhost listener. Attack vector is local with low privileges required, and the advisory lists the affected range as >= 4.5.110, <= 4.6.58, with patched versions stated as >= 4.6.61 in the package metadata. Workarounds are not stated beyond the suggested fix of failing closed or requiring explicit opt-in for degraded fallback. Detection guidance is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-6jcq-6546-qrrw

Impact if exploited

How it is exploited

Attack vector

Local

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Changed

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affects

MervinPraisonPraisonAIMervinPraison PraisonAIpraisonai

Executive summary

A flaw in PraisonAI, a multi-agent teams system, lets an untrusted recipe bypass the dangerous-tool policy and self-approve the critical execute_command shell tool without the operator enabling allow_dangerous_tools. The affected range is stated as 4.5.87 through 4.6.57, and the advisory rates it High with a CVSS 3.1 score of 7.8. The advisory says the fix is version 4.6.61 or later.

Technical summary

The weakness is an authorization bypass (CWE-863) that can lead to OS command injection and code injection (CWE-78, CWE-94). The recipe dangerous-tool check reads only TEMPLATE.yaml requires.tools, while steps-based workflows load workflow.yaml agents.*.tools and top-level approve:, which marks the tool as approved. Exploitation requires an operator to run an untrusted recipe or expose the recipe runner to users who choose recipe names or URIs, and the advisory says user interaction is required. Affected versions are stated as >= 4.5.87, <= 4.6.57, and patched versions as >= 4.6.61. The advisory suggests parsing the workflow tool graph before the policy check and treating approve: as operator-supplied, but it does not describe a workaround for deployed systems. Detection guidance beyond the proof-of-concept reproduction is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-7qw2-w5rc-37x2

Impact if exploited

How it is exploited

Attack vector

Local

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Unchanged

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affects

MervinPraisonMervinPraison PraisonAI

Executive summary

A flaw in PraisonAI's Platform API lets any workspace member permanently delete content created by the workspace owner or other members, including projects, agents, issues, and labels. The advisory rates it High, with a CVSS v3.1 base score of 8.1. The advisory says affected versions are >=0.1.4 and the patched version is >= 0.1.5, so the recommended action is to upgrade praisonai-platform to 0.1.5 or later.

Technical summary

This is an improper authorization flaw (CWE-285) in which DELETE endpoints for six content resource types check workspace membership but not ownership or role, so any member can delete others' content. The attack requires a valid member account in the target workspace, with network access and low privileges and no user interaction, per the CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. Affected versions are stated as >=0.1.4 and patched versions as >= 0.1.5. The advisory does not state any workaround, and it does not state whether the flaw has been exploited in the wild. Detection guidance such as log indicators is not stated; the advisory gives only a proof of concept showing a 204 response to a member's DELETE request where a 403 was expected.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-rh39-9c67-59mh

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Affects

MervinPraisonPraisonAIMervinPraison PraisonAIpraisonai-platform

Executive summary

A flaw in PraisonAI, a multi-agent teams system, lets someone who can influence a file path argument run arbitrary shell commands when compute bridging is enabled. The advisory rates it High, with a CVSS v3.1 score of 8.8, and the affected range is versions 4.6.10 through 4.6.57. The advisory recommends moving file operations to provider-native APIs or structured arguments, and as a stopgap, removing read_file, list_files, and write_file from the compute-bridged tool set; it names the patched version as 4.6.59 or later.

Technical summary

This is an OS command injection flaw (CWE-78, with secondary CWE-863) in the compute-bridged file tools of managed_local.py. Raw path and content arguments are placed into shell command strings for read_file, list_files, and write_file, so a crafted path can break out of quotes and execute commands in the local subprocess or Docker compute environment. The advisory states the attack vector as network with low privileges required and no user interaction, and notes that an unauthenticated deployment may justify PR:N. Affected versions are stated as >= 4.6.10 and <= 4.6.57, and patched versions as >= 4.6.59. Workarounds are given as removing the three file tools from compute_bridged_tools, and no detection guidance beyond the proof-of-concept canary test is stated. Exploitation in the wild is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-w6h2-fr4q-xvxv

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affects

MervinPraisonMervinPraison PraisonAI

Executive summary

The advisory says the PraisonAI AgentOS web deployment accepts requests without authentication, so any client that can reach it can list deployed agents and invoke them. The advisory rates this Critical with a suggested CVSS 3.1 score of 9.8, and states the affected range as >= 4.2.1, <= 4.6.57 with a patched version of >= 4.6.59. The advisory does not state a specific remediation for operators beyond the maintainer fix guidance, and it recommends that maintainers add authentication and bind to 127.0.0.1 by default.

Technical summary

The flaw is missing authentication (CWE-306, CWE-862) and possible exposure of sensitive information (CWE-200) in the AgentOS FastAPI routes GET /api/agents and POST /api/chat, which are reachable without a bearer token and which ignore wrong bearer tokens. The default host is 0.0.0.0, and the advisory says the attack requires only network reachability with no privileges or user interaction. The advisory lists the affected range as >= 4.2.1, <= 4.6.57 and the patched version as >= 4.6.59, and notes that the published patched version 4.5.128 for GHSA-pm96-6xpr-978x still reproduces. A local proof of concept is provided, and the advisory states no workaround is given beyond the suggested fix of enabling authentication and binding to 127.0.0.1. Detection guidance beyond the proof of concept is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-892r-p3jq-jp24

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affects

MervinPraisonMervinPraison PraisonAI

Executive summary

PraisonAI's Jobs API can be tricked into sending webhook requests to internal or cloud metadata addresses that the code is supposed to block, using DNS rebinding. The advisory rates this High and says a patched version is not known at report time, so no fix version is stated. The advisory suggests moving address validation to the moment the outbound connection is made, along with other hardening steps.

Technical summary

This is a server-side request forgery (CWE-918) with a time-of-check to time-of-use weakness (CWE-367): webhook_url is validated once at submission using a resolved public address, but the stored hostname is resolved again when the webhook is sent, so a hostname can resolve to loopback or private addresses at delivery. The attack requires the attacker to submit jobs to a network-reachable Jobs API and control DNS for the webhook hostname; the advisory notes authentication is not required by default. Affected versions are stated as >= 4.5.126, <= 4.6.57, and the advisory states no patched version is known at report time, while the advisory's package metadata lists patched versions as >= 4.6.59. CVSS 3.1 is given as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N with a score of 7.2. Suggested fixes include validating all resolved addresses at send time, pinning the validated IP, and requiring authentication by default, and a local proof-of-concept is provided. Workarounds and vendor-issued detection guidance are not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-rjvw-7vvw-549v

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Changed

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Affects

MervinPraisonPraisonAIMervinPraison PraisonAIpraisonai

Executive summary

A path traversal flaw in PraisonAI's GitHub template cache lets a crafted template reference write files and delete directories outside the cache folder. The advisory rates it High, with a suggested CVSS 3.1 score of 8.1, and it says no fixed version is known at the time of the report.

Technical summary

This is a path traversal weakness (CWE-22, CWE-73) in cache-key construction for GitHub template URIs, where the ref and path segments are joined into a cache path without validation. An attacker who can get a user or service to load a crafted GitHub template URI, with a ref containing parent-directory sequences, can write .cache_meta.json outside the cache and, if a normal cache entry already exists for the same owner/repo/template, delete an attacker-selected directory via shutil.rmtree. The advisory states affected versions as >= 2.6.0, <= 4.6.57, with patched versions listed as >= 4.6.59, and also says no fixed version is known at the time of the report, so the fix status is ambiguous. Suggested workarounds are not stated beyond proposed code fixes, namely strict segment validation, a resolved-path boundary check, and hashing untrusted fields into directory names. No specific detection guidance is given.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-f44v-7qgw-9gh9

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Affects

MervinPraisonPraisonAIMervinPraison PraisonAIpraisonai

Executive summary

A cross-site scripting flaw in PraisonAI's HTTP approval dashboard lets attacker-controlled tool arguments run script when a human opens the approval page, and that script can approve the dangerous tool call without the human clicking Approve. The advisory rates it High, with a suggested CVSS v3.1 score of 8.8. The fix is to escape untrusted values before they are placed in the approval page; the advisory's affected range is 4.5.2 through 4.6.57, and the patched version is 4.6.59 or later.

Technical summary

This is a cross-site scripting (CWE-79) issue in praisonai.bots.HTTPApproval, where _build_html() inserts tool names, risk levels, agent names, and argument keys and values into the approval page without HTML escaping. The attack needs an attacker to influence an agent's prompt or task enough to produce a risky tool call, and the victim must open the approval URL (CVSS AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8). The injected script posts to the same-origin /approve/{request_id}/decide endpoint, which sets approved=True. Affected versions are stated as >= 4.5.2, <= 4.6.57, and the patched version is stated as >= 4.6.59. Workarounds are not stated. The advisory gives a proof of concept and a suggested fix of HTML escaping plus a restrictive Content Security Policy, but no specific detection guidance is stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-63v4-w882-g4x2

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affects

MervinPraisonPraisonAIMervinPraison PraisonAIpraisonai

Executive summary

PraisonAI, a multi-agent teams system, has a flaw where the streaming recipe path (recipe.run_stream) skips the check that blocks dangerous tools by default, so recipes declaring dangerous tools can run without the operator's explicit override. The advisory rates it High (CVSS 3.1 base score 7.8) and affects versions from 4.5.87 through 4.6.57. The advisory's suggested fix is to apply the same policy check to the streaming path, and it lists version 4.6.59 as the patched release.

Technical summary

This is a missing authorization check (CWE-863, with CWE-693 and CWE-78 also suggested), where recipe.run_stream() calls _execute_recipe() without running _check_tool_policy(), so dangerous tools such as execute_command are not denied unless allow_dangerous_tools=True is passed. The attacker needs the ability to invoke recipe streaming, either through the CLI with --stream or the POST /v1/recipes/stream endpoint, and the advisory's CVSS vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Affected versions are stated as >= 4.5.87, <= 4.6.57, and patched versions as >= 4.6.59. The advisory does not state any workaround. Detection guidance is not stated, and the advisory does not say whether the flaw has been exploited in the wild.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-v847-hxxw-3pxg

Impact if exploited

How it is exploited

Attack vector

Local

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Unchanged

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affects

MervinPraisonMervinPraison PraisonAI

Executive summary

PraisonAI's LinearBot component, in versions 4.6.56 through 4.6.58 according to the advisory, accepts forged Linear webhook events when the LINEAR_WEBHOOK_SECRET setting is missing, letting any network caller who can reach the webhook endpoint invoke the configured AI agent. The advisory rates this High with a suggested CVSS 3.1 score of 8.6. The fix is listed as version 4.6.59 and later, and the advisory recommends failing closed by refusing to start or reject requests when no secret is configured.

Technical summary

The flaw is an authentication bypass (CWE-306, CWE-287, CWE-347) in which the webhook handler skips Linear-Signature HMAC verification when no signing secret is set, and the listener binds to 0.0.0.0. An unauthenticated remote attacker who can reach the webhook port can send a forged Linear-Event: AgentSession request, which is passed to the agent through BotSessionManager.chat() and can produce a Linear comment under the bot token. Affected versions are stated as >= 4.6.56, <= 4.6.58, with the patched version given as >= 4.6.59. The advisory also says the component appears in tags back to v4.5.50 and suggests at least 4.5.50 may be affected, but says maintainers should confirm the exact range. Workarounds beyond setting LINEAR_WEBHOOK_SECRET or restricting network access are not stated. Exploitation in the wild is not stated. Detection guidance beyond the proof-of-concept test cases is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-fc26-m9pf-v56q

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Affects

MervinPraisonMervinPraison PraisonAI

Executive summary

A flaw in the PraisonAI praisonai Python package lets the recipe HTTP server run on a network interface without any login when started through the deprecated Typer command. The advisory rates it High with a suggested CVSS 3.1 score of 8.2, and recommends fixing the command path, adding the same guard as the legacy handler, and requiring authentication for remote binding. Affected versions are stated as >= 4.5.112, <= 4.6.58, with patched versions >= 4.6.59.

Technical summary

This is a missing authentication issue (CWE-306, CWE-287, CWE-862) in the deprecated praisonai recipe serve Typer command. Running it with a non-localhost host such as 0.0.0.0 starts the recipe server with CORS set to * and no auth middleware, so unauthenticated network callers can reach recipe endpoints and, if --admin is set, /admin/reload. The advisory states the attack vector is network with no privileges or user interaction required, and the CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N. Affected range is stated as >= 4.5.112, <= 4.6.58 with patched versions >= 4.6.59, and the advisory notes the lower bound is conservative. Suggested fixes include removing or delegating the Typer command, adding a non-localhost/no-auth guard, and adding regression tests. Workarounds beyond these fixes are not stated, and detection guidance is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-5qw8-f2g9-ff29

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Affects

MervinPraisonPraisonAIMervinPraison PraisonAIpraisonai

Executive summary

PraisonAI's Slack bot has an authorization flaw in its app_mention handler, which skips the sender and channel allowlist checks used by the normal message handler. A Slack workspace user who can mention the bot may be able to trigger the configured AI agent despite those restrictions. The advisory rates it High (CVSS 3.1 score 8.3 as shown on the page) and the fix is to upgrade to version 4.6.59 or later.

Technical summary

The flaw is an incorrect and missing authorization check (CWE-863 and CWE-862) in the Slack app_mention event handler in src/praisonai/praisonai/bots/slack.py. The handler does not call is_channel_allowed, is_user_allowed, or UnknownUserHandler.handle, so allowed_users, allowed_channels, and unknown_user_policy=

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-qvpf-j64c-jmhr

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Affects

MervinPraisonMervinPraison PraisonAI

Executive summary

PraisonAI, a multi-agent teams system, has a high-severity flaw in its Dynamic Context Discovery artifact tools that can let a caller read arbitrary files readable by the PraisonAI process on the host, such as .env files, credentials, and SSH keys. The advisory says the affected versions are 3.8.1 through 4.6.58 and that the patched version is 4.6.59 or later. The advisory's recommended fix is to stop artifact tools from opening arbitrary paths and to use artifact IDs or enforce a containment check under the artifact base directory.

Technical summary

The flaw is a path traversal (CWE-22) with sensitive information exposure (CWE-200) in the artifact_head, artifact_tail, artifact_grep, and artifact_chunk tools, which wrap a caller-supplied path directly into an artifact reference and read it from the host filesystem without a base-directory containment check. The attack vector is network, with no privileges or user interaction stated, provided the agent exposed via ctx.get_tools() is reachable by an untrusted prompt or tool caller. The advisory says affected versions are >= 3.8.1, <= 4.6.58 and the patched version is >= 4.6.59. The advisory provides a local proof of concept and recommends resolving paths and rejecting those outside the base directory, plus validating metadata sidecars. Workarounds beyond the suggested code fix are not stated, and whether the advisory provides detection guidance for exploitation attempts is not stated. The advisory describes impact as confidentiality-only, with integrity and availability not claimed. Exploitation in the wild is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-j7qx-p75m-wp7g

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affects

MervinPraisonMervinPraison PraisonAI

Executive summary

PraisonAI, a multi-agent AI teams system, has a path traversal flaw in its Dynamic Context history and terminal tools that lets a lower-trust caller read history and terminal log files outside the configured storage directory. The advisory rates it High, with a suggested CVSS v3.1 score of 7.5, and states that the affected pip package praisonai is affected from version 3.8.1 through 4.6.58. The fix is to upgrade to version 4.6.59 or later, which the advisory lists as the patched version.

Technical summary

The flaw is CWE-22 path traversal, with a related CWE-200 information exposure. The history_* and terminal_* agent tools pass caller-supplied run_id and agent_id values directly into filesystem path construction without rejecting absolute paths or traversal sequences, and the tool-imposed .jsonl or .log suffix still applies. The attack requires only the ability to call these tools with chosen identifiers; the advisory suggests no user interaction and no privileges, though it notes authenticated deployments may score PR:L. Affected versions are stated as >= 3.8.1 and <= 4.6.58, and patched versions as >= 4.6.59. The advisory states no workaround is given, and it does not state any exploitation in the wild. Its suggested fixes are containment checks using resolve() and relative_to() plus an identifier allowlist, but these are recommendations rather than the vendor's stated workaround.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-22cj-m4wf-fv2c

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affects

MervinPraisonMervinPraison PraisonAI

Executive summary

PraisonAI's Discord approval backend can be tricked into approving dangerous tool calls. Any user who can post in the configured approval channel can approve a pending high-risk action by sending a message such as yes after the approval prompt appears. The advisory rates this High, with a suggested CVSS v3.1 score of 8.8 shown in the advisory, and recommends tying approvals to the specific request and checking approver identity.

Technical summary

The flaw is an incorrect authorization issue (CWE-863) with insufficient verification of data authenticity (CWE-345) in DiscordApproval, in src/praisonai/praisonai/bots/_discord_approval.py. The poll loop accepts any later non-bot message in the configured channel as an approval decision, without requiring a Discord reply, a request-specific thread, an interaction or button callback, an approver allowlist, or a per-request nonce. Attack requires only write access to the approval channel and no user interaction after the prompt. Affected versions are stated as >= 4.5.2, <= 4.6.58 and patched versions as >= 4.6.59. The advisory states no workaround. Detection guidance beyond the fix recommendations is not stated, and whether the flaw has been exploited in the wild is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-8579-rgg5-ph2m

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affects

MervinPraisonPraisonAIMervinPraison PraisonAIpraisonai

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affects

MervinPraisonMervinPraison PraisonAIMervinPraison praisonaiagents

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

High

User interaction

None

Scope

Changed

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Affects

MervinPraisonMervinPraison PraisonAI