CVE-2026-61434 - praisonai
The PraisonAI software’s protection that stops risky shell commands can be evaded by using the Unix ‘find’ command with its built‑in ‑exec option. This lets an attacker run…

Too many irrelevant or confusing CVEs? Use stackflag.com

#praisonai #pip #CVE #infosec

CVE-2026-62176 - praisonai
The PraisonAI deployment scripts that build a Python server and Dockerfile insert the supplied agents_file value directly into generated code without checking it. An…

Too many irrelevant or confusing CVEs? Use stackflag.com

#praisonai #mervinpraison #pip #CVE #infosec

Praison AI: 34 CVEs, avg CVSS 7.86, max 9.9. 9 critical, 17 high, yet 0% unpatched and no KEV hits. Path traversal (CWE-22) leads the list. Check the full vendor dossier: https://www.valtersit.com/vendors/praison/ #cybersecurity #infosec #PraisonAI

CVE-2026-57140 - praisonai
Versions 1.6.0 through 1.7.1 of PraisionAI's AgentOS expose two web endpoints that anyone who can reach the server can call without proving who they are. Through these…

Too many irrelevant or confusing CVEs? Use stackflag.com

#praisonai #mervinpraison #npm #CVE #infosec

CVE-2026-57139 - praisonai
Versions 1.5.0 through 1.7.1 of PraisonAI’s MCPServer open a network port that accepts requests without requiring a login. Anyone who can reach that port can ask the…

Too many irrelevant or confusing CVEs? Use stackflag.com

#praisonai #mervinpraison #npm #CVE #infosec

CVE-2026-57138 - praisonai
Versions 1.4.0 through 1.7.1 of PraisonAI allow code entered into the codeMode feature to break out of its sandbox and run arbitrary commands on the server. An…

Too many irrelevant or confusing CVEs? Use stackflag.com

#praisonai #mervinpraison #npm #CVE #infosec

CVE-2026-57141 - praisonai
Versions of PraisonAI before 1.7.2 let a user who can influence the codeMode tool run their own JavaScript, which can break out of the sandbox and access the server.…

Too many irrelevant or confusing CVEs? Use stackflag.com

#praisonai #mervinpraison #npm #CVE #infosec

CVE-2026-57141 - praisonai
Versions of PraisonAI prior to 1.7.2 run user‑supplied JavaScript in a way that can be bypassed, giving an attacker the ability to execute operating‑system commands, read…

Too many irrelevant or confusing CVEs? Use stackflag.com

#praisonai #mervinpraison #CVE #infosec

CVE-2026-57140 - praisonai
Versions 1.6.0 through 1.7.2 of PraisonAI expose API endpoints that let anyone on the network view agent details and send commands without proving who they are. This could…

Too many irrelevant or confusing CVEs? Use stackflag.com

#praisonai #mervinpraison #CVE #infosec

CVE-2026-57139 - praisonai
Versions 1.5.0 through 1.7.2 of PraisonAI run an HTTP listener that does not restrict which computer can connect and does not check who is making the request. Any device…

Too many irrelevant or confusing CVEs? Use stackflag.com

#praisonai #mervinpraison #CVE #infosec

CVE-2026-57138 - praisonai
Versions of PraisonAI from 1.4.0 through 1.7.1 run user‑provided JavaScript in a weak isolation that can be bypassed. An attacker could read confidential files, change data…

Too many irrelevant or confusing CVEs? Use stackflag.com

#praisonai #mervinpraison #CVE #infosec

CVE-2026-57125 - praisonai
Versions of PraisonAI and its agent component before 4.6.59 (and 1.6.59 for agents) let anyone on the internet send a request that runs operating-system commands on the…

Too many irrelevant or confusing CVEs? Use stackflag.com

#praisonai #mervinpraison #CVE #infosec