PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced

PraisonAI before 4.6.78 Allowlist Bypass via find -exec

PraisonAI affected by arbitrary file write via path traversal in `praisonai recipe unpack`

PraisonAI has a Template Injection in Agent Tool Definitions

PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate

PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing

PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)

PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete

PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution

PraisonAI before 4.6.78 Missing Webhook Signature Verification

PraisonAI before 1.7.3 Unauthenticated Agent Access via Insecure Defaults

PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute

PraisonAI: SSRF in FileTools.download_file() via Unvalidated URL

praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS

PraisonAI: SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)

PraisonAI before 1.6.78 DNS Rebinding SSRF via web_crawl

PraisonAI before 1.6.78 SSRF via Crawl4AI Chromium backend

PraisonAI before 1.6.78 Remote Code Execution via Plugin Auto-Discovery

PraisonAI: Unauthenticated RCE via `tool_override.py`

PraisonAI has RCE via Automatic tools.py Import

PraisonAI Slack app_mention bypasses configured user/channel authorization

PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools

PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard

PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation

PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication

PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret

praisonaiagents: AgentServer declares auth_token but never enforces it on any route (CWE-862)

PraisonAI before 4.6.78 Authentication Bypass via Host Header Spoofing

PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API

PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion

PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334

PraisonAI before 1.6.78 Remote Code Execution via SkillTools

PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)

PraisonAI has an Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars

PraisonAI has an Arbitrary File Write (Zip Slip) in Templates Extraction

PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml

PraisonAI recipe.run_stream skips dangerous-tool policy enforcement

PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code

PraisonAI before 4.6.78 Code Injection via API deployment generator

PraisonAI before 1.6.78 Remote Code Execution via tools.py

PraisonAI has Improper Control of Generation of Code ('Code Injection') and Protection Mechanism Failure in praisonai

PraisonAI Affected by Implicit Execution of Arbitrary Code via Automatic `tools.py` Loading

PraisonAI has a`web_crawl` SSRF protection bypass via unchecked redirect targets

PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback

PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients

PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server

PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default

PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage

PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal

PraisonAI: Unauthenticated Local File Inclusion via agent_file path in the Jobs API