Praisonai

This hub aggregates every CVE we track for Praisonai, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Praisonai.

• CVE-2026-57147praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery9.8Sep 15, 2026
• CVE-2026-57148praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)9.8Sep 15, 2026
• CVE-2026-57140PraisonAI AgentOS exposes unauthenticated agent listing and invocation9.4Sep 15, 2026
• CVE-2026-57139PraisonAI MCPServer exposes unauthenticated HTTP tools/call9.8Sep 15, 2026
• CVE-2026-57133PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining8.8Sep 15, 2026
• CVE-2026-57135PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients7.6Sep 15, 2026
• CVE-2026-57134PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation8.2Sep 15, 2026
• CVE-2026-57138PraisonAI codeMode sandbox escape via Function constructor9.9Sep 15, 2026
• CVE-2026-57136PraisonAI SandboxExecutor allowedCommands bypass via shell chaining8.8Sep 15, 2026
• CVE-2026-57137PraisonAI AgentLoop onToolCall approval runs after tool execution8.8Sep 15, 2026
• CVE-2026-57141PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool9.8Sep 15, 2026
• CVE-2026-57112PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools8.3Sep 15, 2026
• CVE-2026-57145PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation9.1Sep 14, 2026
• CVE-2026-57132PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication8.2Sep 14, 2026
• CVE-2026-57131praisonai: Jobs API exposes agent-execution endpoints with no authentication9.8Sep 14, 2026