LLM frameworks · PraisonAI
PraisonAI
Open-source Python framework for multi-agent AI systems.
11Advisories
7critical
4high
0medium
2026-10-23Latest
PraisonAI CVEs & security
Is PraisonAI safe?
PraisonAI is a multi-agent framework with Python and npm packages. Its advisories cover unauthenticated agent and MCP servers, sandbox escapes, and tools that let the model read or overwrite files, so an internet-facing install is high risk.
We track 11 security advisories that affect PraisonAI. By severity: 7 critical and 4 high. All of them have a CVE ID. The most common kinds are broken access control (7), code execution (2) and agent hijacking (2). The newest entry is dated 2026-10-23.
Newest entries on this page
- CVE-2026-57113: A crafted PraisonAI GitHub template ref can delete folders outside the template cache high 2026-10-23
- CVE-2026-57121: Any praisonai-platform workspace member can delete everyone else's projects and agents high 2026-10-23
- CVE-2026-56840: PraisonAI's human approval for dangerous tools could be bypassed, plus file reads and unsigned Linear webhooks high 2026-10-23
Using PraisonAI safely
- Upgrade praisonai, praisonaiagents, the npm praisonai package and praisonai-platform to the fixed versions listed in each advisory below.
- Do not expose AgentTeam, AgentOS, MCP SSE or MCPServer to the internet without authentication. Bind to 127.0.0.1 unless you need remote access.
- Set PLATFORM_JWT_SECRET to a strong random value and PLATFORM_ENV=production; older platform builds signed logins with a public default secret.
- Run agents that execute code or use file tools in a sandbox or container with no access to real credentials or production data.
- Only load GitHub templates from repos and refs you trust; a crafted template ref could delete folders outside the template tree.
Timeline · advisories per quarter
12026 Q2
62026 Q3
42026 Q4
Named in sources
Reported for PraisonAI
01. CVE-2026-57141: PraisonAI's codeMode tool sandbox can be escaped to run OS commandsIn the praisonai npm package up to 1.7.1, the codeMode tool runs model-generated JavaScript with new Function() and a regex blocklist that's easy to bypass. Anyone who can influence that code, for example through prompt injection, can read files, steal credentials and run OS commands. Fixed in 1.7.2. PraisonAI 2026-09-15 02. CVE-2026-57147: praisonai-platform signs logins with the public secret dev-secret-change-mepraisonai-platform 0.1.4 and earlier fall back to the hardcoded JWT secret dev-secret-change-me when PLATFORM_JWT_SECRET is unset, and the production guard is off because PLATFORM_ENV defaults to dev. Anyone can forge a token and act as any user or workspace owner. Fixed in 0.1.6. PraisonAI 2026-09-15 03. CVE-2026-57139: PraisonAI's npm MCP server and AgentOS let anyone call tools and agentsIn the praisonai npm package up to 1.7.1, the TypeScript MCPServer's HTTP transport has no authentication and listens on all interfaces, so anyone who reaches the port can list and call tools, read resources and get prompts. AgentOS has the same problem for agents (CVE-2026-57140), and version 1.7.2 also fixes another codeMode sandbox escape (CVE-2026-57138). PraisonAI 
MCP SDKs & servers 2026-09-15 04. CVE-2026-57123: praisonaiagents MCP SSE server exposes every tool with no authBefore praisonaiagents 1.6.59, ToolsMCPServer.run_sse() and launch_tools_mcp_server(transport="sse") bind to 0.0.0.0 with no authentication or Origin check. Anyone who can reach the port can list and run every registered tool, and a web page can drive a localhost instance through DNS rebinding. The library's own security controls were never wired in. PraisonAI MCP SDKs & servers 2026-09-14 05. CVE-2026-57145: PraisonAI's multiedit tool lets the model read and overwrite any filePraisonAI's multiedit agent tool passed the model-controlled file path straight to open() for reading and writing, with no traversal check, workspace boundary, symlink resolution or protected-path guard. Anyone who can influence an agent's tool arguments, for example through prompt injection or a malicious YAML workflow, can read secrets like SSH keys and overwrite files. PraisonAI 2026-09-14 06. CVE-2026-61447 and CVE-2026-61445: PraisonAI ran LLM-written code and commands with no sandboxTwo PraisonAI advisories: CodeAgent ran model-generated Python with the full environment (every API key and credential) and ignored sandbox=True, and the AICoder UI let the model write any file and run any command. Prompt injection turns either one into code execution. PraisonAI 2026-07-11 07. CVE-2026-57118: PraisonAI's AgentTeam.launch() served agents to anyone, no authBefore praisonaiagents 1.6.59, the HTTP server started by AgentTeam.launch() (alias Agents.launch()) accepted requests with no token or a wrong one, and it binds to 0.0.0.0 by default. Anyone who could reach it could list agents and make them run, using your model credits, private context and tools. PraisonAI 2026-06-18 08. CVE-2026-57113: A crafted PraisonAI GitHub template ref can delete folders outside the template cachePraisonAI's template loader builds its cache path from the owner, repo, template and ref of a github: template URI without checking the result stays inside the cache. A ref like ../../../outside-target escapes it, writes a .cache_meta.json file elsewhere and, once a normal cache entry exists for the same template, deletes an attacker-chosen directory. Affects praisonai 2.6.0 through 4.6.57; fixed in 4.6.59. PraisonAI 2026-10-23 09. CVE-2026-57121: Any praisonai-platform workspace member can delete everyone else's projects and agentsIn praisonai-platform 0.1.4, the DELETE endpoints for projects, agents, issues, labels, issue dependencies and issue-label links only check that the caller is a workspace member. A single malicious or compromised member account can permanently wipe content created by the owner and other members. GitHub lists 0.1.6 as the first patched version; NVD's text says 0.1.5. PraisonAI 2026-10-23 10. CVE-2026-56840: PraisonAI's human approval for dangerous tools could be bypassed, plus file reads and unsigned Linear webhooksFive PraisonAI CVEs published on 23 October 2026 cover bugs fixed in praisonai 4.6.59. Two let someone approve a dangerous tool call without the real approver: a tool argument that injects script into the HTTP approval dashboard, and any 'yes' typed in the Discord approval channel. The others let a prompt read files outside PraisonAI's storage and let anyone send forged Linear webhooks to LinearBot when no secret is set. PraisonAI 2026-10-23 11. CVE-2026-57143: PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_web SearxNG provider pass the LLM-controlled searxng_urlPraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_web SearxNG provider pass the LLM-controlled searxng_url parameter directly to requests.get without validating its scheme, host, port, or resolved address. PraisonAI 2026-10-12
PraisonAI 2026-09-15 02. CVE-2026-57147: praisonai-platform signs logins with the public secret dev-secret-change-mepraisonai-platform 0.1.4 and earlier fall back to the hardcoded JWT secret dev-secret-change-me when PLATFORM_JWT_SECRET is unset, and the production guard is off because PLATFORM_ENV defaults to dev. Anyone can forge a token and act as any user or workspace owner. Fixed in 0.1.6. PraisonAI 2026-09-15 03. CVE-2026-57139: PraisonAI's npm MCP server and AgentOS let anyone call tools and agentsIn the praisonai npm package up to 1.7.1, the TypeScript MCPServer's HTTP transport has no authentication and listens on all interfaces, so anyone who reaches the port can list and call tools, read resources and get prompts. AgentOS has the same problem for agents (CVE-2026-57140), and version 1.7.2 also fixes another codeMode sandbox escape (CVE-2026-57138). PraisonAI MCP SDKs & servers 2026-09-15 04. CVE-2026-57123: praisonaiagents MCP SSE server exposes every tool with no authBefore praisonaiagents 1.6.59, ToolsMCPServer.run_sse() and launch_tools_mcp_server(transport="sse") bind to 0.0.0.0 with no authentication or Origin check. Anyone who can reach the port can list and run every registered tool, and a web page can drive a localhost instance through DNS rebinding. The library's own security controls were never wired in. PraisonAI MCP SDKs & servers 2026-09-14 05. CVE-2026-57145: PraisonAI's multiedit tool lets the model read and overwrite any filePraisonAI's multiedit agent tool passed the model-controlled file path straight to open() for reading and writing, with no traversal check, workspace boundary, symlink resolution or protected-path guard. Anyone who can influence an agent's tool arguments, for example through prompt injection or a malicious YAML workflow, can read secrets like SSH keys and overwrite files. PraisonAI 2026-09-14 06. CVE-2026-61447 and CVE-2026-61445: PraisonAI ran LLM-written code and commands with no sandboxTwo PraisonAI advisories: CodeAgent ran model-generated Python with the full environment (every API key and credential) and ignored sandbox=True, and the AICoder UI let the model write any file and run any command. Prompt injection turns either one into code execution. PraisonAI 2026-07-11 07. CVE-2026-57118: PraisonAI's AgentTeam.launch() served agents to anyone, no authBefore praisonaiagents 1.6.59, the HTTP server started by AgentTeam.launch() (alias Agents.launch()) accepted requests with no token or a wrong one, and it binds to 0.0.0.0 by default. Anyone who could reach it could list agents and make them run, using your model credits, private context and tools. PraisonAI 2026-06-18 08. CVE-2026-57113: A crafted PraisonAI GitHub template ref can delete folders outside the template cachePraisonAI's template loader builds its cache path from the owner, repo, template and ref of a github: template URI without checking the result stays inside the cache. A ref like ../../../outside-target escapes it, writes a .cache_meta.json file elsewhere and, once a normal cache entry exists for the same template, deletes an attacker-chosen directory. Affects praisonai 2.6.0 through 4.6.57; fixed in 4.6.59. PraisonAI 2026-10-23 09. CVE-2026-57121: Any praisonai-platform workspace member can delete everyone else's projects and agentsIn praisonai-platform 0.1.4, the DELETE endpoints for projects, agents, issues, labels, issue dependencies and issue-label links only check that the caller is a workspace member. A single malicious or compromised member account can permanently wipe content created by the owner and other members. GitHub lists 0.1.6 as the first patched version; NVD's text says 0.1.5. PraisonAI 2026-10-23 10. CVE-2026-56840: PraisonAI's human approval for dangerous tools could be bypassed, plus file reads and unsigned Linear webhooksFive PraisonAI CVEs published on 23 October 2026 cover bugs fixed in praisonai 4.6.59. Two let someone approve a dangerous tool call without the real approver: a tool argument that injects script into the HTTP approval dashboard, and any 'yes' typed in the Discord approval channel. The others let a prompt read files outside PraisonAI's storage and let anyone send forged Linear webhooks to LinearBot when no secret is set. PraisonAI 2026-10-23 11. CVE-2026-57143: PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_web SearxNG provider pass the LLM-controlled searxng_urlPraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_web SearxNG provider pass the LLM-controlled searxng_url parameter directly to requests.get without validating its scheme, host, port, or resolved address. PraisonAI 2026-10-12