@stackflag.bsky.socialCVE-2026-62176 - praisonai
The PraisonAI deployment scripts that build a Python server and Dockerfile insert the supplied agents_file value directly into generated code without checking it. An…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-57140 - praisonai
Versions 1.6.0 through 1.7.1 of PraisionAI's AgentOS expose two web endpoints that anyone who can reach the server can call without proving who they are. Through these…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-57139 - praisonai
Versions 1.5.0 through 1.7.1 of PraisonAI’s MCPServer open a network port that accepts requests without requiring a login. Anyone who can reach that port can ask the…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-57138 - praisonai
Versions 1.4.0 through 1.7.1 of PraisonAI allow code entered into the codeMode feature to break out of its sandbox and run arbitrary commands on the server. An…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-57141 - praisonai
Versions of PraisonAI before 1.7.2 let a user who can influence the codeMode tool run their own JavaScript, which can break out of the sandbox and access the server.…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-57123 - praisonaiagents
The PraisonAI MCP server is exposed to the public internet without authentication or origin validation. This allows anyone to access and use the tools…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-57141 - praisonai
Versions of PraisonAI prior to 1.7.2 run user‑supplied JavaScript in a way that can be bypassed, giving an attacker the ability to execute operating‑system commands, read…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-57140 - praisonai
Versions 1.6.0 through 1.7.2 of PraisonAI expose API endpoints that let anyone on the network view agent details and send commands without proving who they are. This could…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-57139 - praisonai
Versions 1.5.0 through 1.7.2 of PraisonAI run an HTTP listener that does not restrict which computer can connect and does not check who is making the request. Any device…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-57138 - praisonai
Versions of PraisonAI from 1.4.0 through 1.7.1 run user‑provided JavaScript in a weak isolation that can be bypassed. An attacker could read confidential files, change data…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-57125 - praisonaiagents
Versions of PraisonAI and PraisonAIAgents older than 4.6.59 and 1.6.59 let anyone send a specially crafted request to run arbitrary system commands. This…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-57123 - praisonaiagents
The PraisonAI agents component opens its network interface to all computers and does not require a login or verify where requests originate. Because of this,…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-57125 - praisonai
Versions of PraisonAI and its agent component before 4.6.59 (and 1.6.59 for agents) let anyone on the internet send a request that runs operating-system commands on the…
Too many irrelevant or confusing CVEs? Use stackflag.com