PraisonAI: Origin validation bypass in MCP HTTP Stream transport allows browser-mediated unauthenticated tool execution on local MCP server

PraisonAI: Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation

PraisonAI: SpiderTools redirect-target SSRF protection bypass

PraisonAI: Unauthenticated unbounded session accumulation in the PraisonAI MCP HTTP server (memory exhaustion; session TTL never enforced)

PraisonAI Platform before 0.1.9 Authorization Bypass via Label Endpoints

PraisonAI Platform before 0.1.9 Authorization Bypass via Dependencies

PraisonAI Affected by Decompression Bomb DoS via Recipe Bundle Extraction Without Size Limits

PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries

PraisonAI: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool

PraisonAI before 1.6.78 Tool Approval Cache Bypass

PraisonAI has Stored XSS via Unsanitized Agent Output in HTML Rendering (nh3 Not a Required Dependency)

PraisonAI FastContext before 1.6.78 Path Traversal

PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context

PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings

PraisonAI before 4.6.78 Path Traversal via Custom Commands

PraisonAI before 4.6.78 Path Traversal via ContextGatherer

PraisonAI before 1.6.78 Path Traversal via config.toml

PraisonAI Exposes Sensitive Environment Variable via Untrusted MCP Subprocess Execution

PraisonAI before 4.6.78 Prompt Injection Defense Bypass

PraisonAI Affected by Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOS

PraisonAI: Unauthenticated Event Injection via SSE `/publish` Endpoint