Vulnerability feed

Executive summary

PraisonAI, a multi-agent teams system, has a flaw in its Sandlock sandbox that can let code run outside its intended isolation when the kernel feature Landlock is unavailable. The advisory rates it High, with a suggested CVSS 3.1 score of 8.8 and a suggested severity of High. The advisory states that no fixed version is known at submission time, and its suggested fix is to make the sandbox fail closed instead of falling back to unrestricted execution.

Technical summary

The flaw is a protection mechanism failure (CWE-693) in praisonai.sandbox.SandlockSandbox. When the optional sandlock module reports that Landlock is unavailable, execute() and run_command() silently fall back to SubprocessSandbox, which does not enforce the configured filesystem allowlist or network=False setting. The advisory's proof of concept showed code reading a file outside the allowed path and connecting to a localhost listener. Attack vector is local with low privileges required, and the advisory lists the affected range as >= 4.5.110, <= 4.6.58, with patched versions stated as >= 4.6.61 in the package metadata. Workarounds are not stated beyond the suggested fix of failing closed or requiring explicit opt-in for degraded fallback. Detection guidance is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-6jcq-6546-qrrw

Impact if exploited

How it is exploited

Attack vector

Local

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Changed

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affects

MervinPraisonPraisonAIMervinPraison PraisonAIpraisonai

Executive summary

A flaw in PraisonAI's Platform API lets any workspace member permanently delete content created by the workspace owner or other members, including projects, agents, issues, and labels. The advisory rates it High, with a CVSS v3.1 base score of 8.1. The advisory says affected versions are >=0.1.4 and the patched version is >= 0.1.5, so the recommended action is to upgrade praisonai-platform to 0.1.5 or later.

Technical summary

This is an improper authorization flaw (CWE-285) in which DELETE endpoints for six content resource types check workspace membership but not ownership or role, so any member can delete others' content. The attack requires a valid member account in the target workspace, with network access and low privileges and no user interaction, per the CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. Affected versions are stated as >=0.1.4 and patched versions as >= 0.1.5. The advisory does not state any workaround, and it does not state whether the flaw has been exploited in the wild. Detection guidance such as log indicators is not stated; the advisory gives only a proof of concept showing a 204 response to a member's DELETE request where a 403 was expected.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-rh39-9c67-59mh

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Affects

MervinPraisonPraisonAIMervinPraison PraisonAIpraisonai-platform

Executive summary

PraisonAI's Jobs API can be tricked into sending webhook requests to internal or cloud metadata addresses that the code is supposed to block, using DNS rebinding. The advisory rates this High and says a patched version is not known at report time, so no fix version is stated. The advisory suggests moving address validation to the moment the outbound connection is made, along with other hardening steps.

Technical summary

This is a server-side request forgery (CWE-918) with a time-of-check to time-of-use weakness (CWE-367): webhook_url is validated once at submission using a resolved public address, but the stored hostname is resolved again when the webhook is sent, so a hostname can resolve to loopback or private addresses at delivery. The attack requires the attacker to submit jobs to a network-reachable Jobs API and control DNS for the webhook hostname; the advisory notes authentication is not required by default. Affected versions are stated as >= 4.5.126, <= 4.6.57, and the advisory states no patched version is known at report time, while the advisory's package metadata lists patched versions as >= 4.6.59. CVSS 3.1 is given as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N with a score of 7.2. Suggested fixes include validating all resolved addresses at send time, pinning the validated IP, and requiring authentication by default, and a local proof-of-concept is provided. Workarounds and vendor-issued detection guidance are not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-rjvw-7vvw-549v

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Changed

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Affects

MervinPraisonPraisonAIMervinPraison PraisonAIpraisonai

Executive summary

A path traversal flaw in PraisonAI's GitHub template cache lets a crafted template reference write files and delete directories outside the cache folder. The advisory rates it High, with a suggested CVSS 3.1 score of 8.1, and it says no fixed version is known at the time of the report.

Technical summary

This is a path traversal weakness (CWE-22, CWE-73) in cache-key construction for GitHub template URIs, where the ref and path segments are joined into a cache path without validation. An attacker who can get a user or service to load a crafted GitHub template URI, with a ref containing parent-directory sequences, can write .cache_meta.json outside the cache and, if a normal cache entry already exists for the same owner/repo/template, delete an attacker-selected directory via shutil.rmtree. The advisory states affected versions as >= 2.6.0, <= 4.6.57, with patched versions listed as >= 4.6.59, and also says no fixed version is known at the time of the report, so the fix status is ambiguous. Suggested workarounds are not stated beyond proposed code fixes, namely strict segment validation, a resolved-path boundary check, and hashing untrusted fields into directory names. No specific detection guidance is given.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-f44v-7qgw-9gh9

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Affects

MervinPraisonPraisonAIMervinPraison PraisonAIpraisonai

Executive summary

A cross-site scripting flaw in PraisonAI's HTTP approval dashboard lets attacker-controlled tool arguments run script when a human opens the approval page, and that script can approve the dangerous tool call without the human clicking Approve. The advisory rates it High, with a suggested CVSS v3.1 score of 8.8. The fix is to escape untrusted values before they are placed in the approval page; the advisory's affected range is 4.5.2 through 4.6.57, and the patched version is 4.6.59 or later.

Technical summary

This is a cross-site scripting (CWE-79) issue in praisonai.bots.HTTPApproval, where _build_html() inserts tool names, risk levels, agent names, and argument keys and values into the approval page without HTML escaping. The attack needs an attacker to influence an agent's prompt or task enough to produce a risky tool call, and the victim must open the approval URL (CVSS AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8). The injected script posts to the same-origin /approve/{request_id}/decide endpoint, which sets approved=True. Affected versions are stated as >= 4.5.2, <= 4.6.57, and the patched version is stated as >= 4.6.59. Workarounds are not stated. The advisory gives a proof of concept and a suggested fix of HTML escaping plus a restrictive Content Security Policy, but no specific detection guidance is stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-63v4-w882-g4x2

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affects

MervinPraisonPraisonAIMervinPraison PraisonAIpraisonai

Executive summary

A flaw in the PraisonAI praisonai Python package lets the recipe HTTP server run on a network interface without any login when started through the deprecated Typer command. The advisory rates it High with a suggested CVSS 3.1 score of 8.2, and recommends fixing the command path, adding the same guard as the legacy handler, and requiring authentication for remote binding. Affected versions are stated as >= 4.5.112, <= 4.6.58, with patched versions >= 4.6.59.

Technical summary

This is a missing authentication issue (CWE-306, CWE-287, CWE-862) in the deprecated praisonai recipe serve Typer command. Running it with a non-localhost host such as 0.0.0.0 starts the recipe server with CORS set to * and no auth middleware, so unauthenticated network callers can reach recipe endpoints and, if --admin is set, /admin/reload. The advisory states the attack vector is network with no privileges or user interaction required, and the CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N. Affected range is stated as >= 4.5.112, <= 4.6.58 with patched versions >= 4.6.59, and the advisory notes the lower bound is conservative. Suggested fixes include removing or delegating the Typer command, adding a non-localhost/no-auth guard, and adding regression tests. Workarounds beyond these fixes are not stated, and detection guidance is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-5qw8-f2g9-ff29

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Affects

MervinPraisonPraisonAIMervinPraison PraisonAIpraisonai

Executive summary

PraisonAI's Discord approval backend can be tricked into approving dangerous tool calls. Any user who can post in the configured approval channel can approve a pending high-risk action by sending a message such as yes after the approval prompt appears. The advisory rates this High, with a suggested CVSS v3.1 score of 8.8 shown in the advisory, and recommends tying approvals to the specific request and checking approver identity.

Technical summary

The flaw is an incorrect authorization issue (CWE-863) with insufficient verification of data authenticity (CWE-345) in DiscordApproval, in src/praisonai/praisonai/bots/_discord_approval.py. The poll loop accepts any later non-bot message in the configured channel as an approval decision, without requiring a Discord reply, a request-specific thread, an interaction or button callback, an approver allowlist, or a per-request nonce. Attack requires only write access to the approval channel and no user interaction after the prompt. Affected versions are stated as >= 4.5.2, <= 4.6.58 and patched versions as >= 4.6.59. The advisory states no workaround. Detection guidance beyond the fix recommendations is not stated, and whether the flaw has been exploited in the wild is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-8579-rgg5-ph2m

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affects

MervinPraisonPraisonAIMervinPraison PraisonAIpraisonai