AgentArmorHQ
Sign in

PraisonAI

MCP server · PyPI · ★ 9.3k · graded 2026-10-24Source linked

AI Agents Framework with Self Reflection and MCP support

11 incidents, 200 advisories on file

PraisonAI is distributed via PyPI (praisonai); review its source code, dependencies, and requested permissions before use.

Based on public adoption and transparency signals as of Oct 24, 2026. Our opinion, not a code audit or security guarantee.

Was this verdict for PraisonAI helpful?

What it can access

  • Local filesNo local folder access notedLOW
  • Command executionRuns shell or system commandsREVIEW
  • Network reachConnects to outside service APINOTED
  • CredentialsNo API token requiredLOW
  • Package sourcePyPI (praisonai)PUBLIC

Inferred from this listing’s public package details and description. Check the project’s source before installing.

Install

uvx praisonai

All setup options ↓

Check this skillWatch it in my stackCompareREADME badgeView project

Everything known

6 critical incidents, 23 critical advisories, 3 high incidents, 58 high advisories, 2 medium incidents, 16 medium advisories and 103 with no severity listed on record. The newest is from 2026-10-15. Every report lists a fix. Check each one for the version.

11 incidents · 200 advisories · 0 news articles · 0 community threads · checked 2026-10-30

Popularity grade: B (from public signals such as stars and downloads, not a code review). Graded 2026-10-24.

Showing 1-10 of 211Showing all 211Showing 11 incidents of 211Showing 200 advisories of 211

  1. AdvisoryPraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofingOSV · 2026-10-15 · Fixed in 4.6.78
  2. AdvisoryPraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agentsOSV · 2026-10-15 · Fixed in 4.6.78
  3. AdvisoryPraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool CallsOSV · 2026-10-15 · Fixed in 4.6.78
  4. AdvisoryPraisonAI: API deploy code generator embeds unescaped YAML fields into Python sourceOSV · 2026-10-15 · Fixed in 4.6.78
  5. AdvisoryPraisonAI: Call API localhost-only authentication bypass via spoofed Host headerOSV · 2026-10-15 · Fixed in 4.6.78
  6. AdvisoryPraisonAI: Code Injection via f-string Interpolation in Deploy API Server GenerationOSV · 2026-10-15 · Fixed in 4.6.78
  7. AdvisoryPraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspaceOSV · 2026-10-15 · Fixed in 4.6.78
  8. AdvisoryPraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRFOSV · 2026-10-15 · Fixed in 4.6.78
  9. AdvisoryPraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surfaceOSV · 2026-10-15 · Fixed in 4.6.78
  10. AdvisoryPraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDLOSV · 2026-10-15 · Fixed in 4.6.78
  11. AdvisoryPraisonAI: Project custom command templates can read outside-workspace files into model promptsOSV · 2026-10-15 · Fixed in 4.6.78
  12. AdvisoryPraisonAI: Prompt Injection Defense Bypassed for HIGH-Level ThreatsOSV · 2026-10-15 · Fixed in 4.6.78
  13. AdvisoryPraisonAI: Prompt-injection defense blocks only when 3+ detector families fire simultaneously; realistic single-vector injections pass through unblockedOSV · 2026-10-15 · Fixed in 4.6.78
  14. AdvisoryPraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backendOSV · 2026-10-15 · Fixed in 4.6.78
  15. AdvisoryPraisonAI: Shell command allowlist bypass via find -exec built-in actionOSV · 2026-10-15 · Fixed in 4.6.78
  16. IncidentCVE-2026-61427: PraisonAI MCP HTTP-stream transport unauthenticated by default (<= 4.6.77)AgentArmorHQ incident library · 2026-10-08 · Severity: High · Fixed in 4.6.78
  17. AdvisoryPraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool CallsOSV · 2026-10-08 · Severity: Critical · Fixed in 4.6.78
  18. AdvisoryPraisonAI: API deploy code generator embeds unescaped YAML fields into Python sourceOSV · 2026-10-08 · Severity: High · Fixed in 4.6.78
  19. AdvisoryPraisonAI: Call API localhost-only authentication bypass via spoofed Host headerOSV · 2026-10-08 · Severity: High · Fixed in 4.6.78
  20. AdvisoryPraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspaceOSV · 2026-10-08 · Severity: Medium · Fixed in 4.6.78
  21. AdvisoryPraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRFOSV · 2026-10-08 · Severity: High · Fixed in 4.6.78
  22. AdvisoryPraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDLOSV · 2026-10-08 · Severity: Medium · Fixed in 4.6.78
  23. AdvisoryPraisonAI: Project custom command templates can read outside-workspace files into model promptsOSV · 2026-10-08 · Severity: Medium · Fixed in 4.6.78
  24. AdvisoryPraisonAI: Prompt-injection defense blocks only when 3+ detector families fire simultaneously; realistic single-vector injections pass through unblockedOSV · 2026-10-08 · Severity: Medium · Fixed in 4.6.78
  25. AdvisoryPraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backendOSV · 2026-10-08 · Severity: High · Fixed in 4.6.78
  26. AdvisoryPraisonAI: Shell command allowlist bypass via find -exec built-in actionOSV · 2026-10-08 · Severity: High · Fixed in 4.6.78
  27. AdvisoryPraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofingOSV · 2026-10-07 · Severity: High · Fixed in 4.6.78
  28. AdvisoryPraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agentsOSV · 2026-10-07 · Severity: High · Fixed in 4.6.78
  29. AdvisoryPraisonAI: Code Injection via f-string Interpolation in Deploy API Server GenerationOSV · 2026-10-07 · Severity: Critical · Fixed in 4.6.78
  30. AdvisoryPraisonAI: Prompt Injection Defense Bypassed for HIGH-Level ThreatsOSV · 2026-10-07 · Severity: High · Fixed in 4.6.78
  31. AdvisoryPraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)OSV · 2026-09-10 · Fixed in 4.6.58
  32. AdvisoryPraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local MCP serverOSV · 2026-09-10 · Fixed in 4.6.58
  33. AdvisoryPraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced)OSV · 2026-09-10 · Fixed in 4.6.58
  34. AdvisoryPraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent executionOSV · 2026-09-10 · Fixed in 4.6.58
  35. AdvisoryPraisonAI vulnerable to Server-Side Request Forgery via DNS rebinding bypass in webhook_url validationOSV · 2026-09-10 · Fixed in 4.6.58
  36. AdvisoryPraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe codeOSV · 2026-09-10 · Fixed in 4.6.58
  37. AdvisoryPraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauOSV · 2026-09-10 · Fixed in 4.6.58
  38. AdvisoryPraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and deleteOSV · 2026-09-10 · Fixed in 4.6.58
  39. AdvisoryPraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinksOSV · 2026-09-10 · Fixed in 4.6.58
  40. AdvisoryPraisonAI: `--api-key` flag on `praisonai serve` is not properly enforcedOSV · 2026-09-10 · Fixed in 4.6.58
  41. AdvisoryPraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secretOSV · 2026-09-10 · Fixed in 4.6.58
  42. AdvisoryPraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP serverOSV · 2026-09-10 · Fixed in 4.6.58
  43. AdvisoryPraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114OSV · 2026-09-10 · Fixed in 4.6.58
  44. IncidentPraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced)AgentArmorHQ incident library · 2026-08-25 · Severity: Medium · Fixed in 4.6.58
  45. Incidentpraisonaiagents vulnerable to SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap)AgentArmorHQ incident library · 2026-08-25 · Severity: High · Fixed in 1.6.58
  46. AdvisoryPraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)OSV · 2026-08-25 · Severity: Critical · Fixed in 4.6.58
  47. AdvisoryPraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local MCP serverOSV · 2026-08-25 · Severity: Medium · Fixed in 4.6.58
  48. AdvisoryPraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent executionOSV · 2026-08-25 · Severity: High · Fixed in 4.6.58
  49. AdvisoryPraisonAI vulnerable to Server-Side Request Forgery via DNS rebinding bypass in webhook_url validationOSV · 2026-08-25 · Severity: Medium · Fixed in 4.6.58
  50. AdvisoryPraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe codeOSV · 2026-08-25 · Severity: High · Fixed in 4.6.58
  51. AdvisoryPraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauOSV · 2026-08-25 · Severity: High · Fixed in 4.6.58
  52. AdvisoryPraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and deleteOSV · 2026-08-25 · Severity: High · Fixed in 4.6.58
  53. AdvisoryPraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinksOSV · 2026-08-25 · Severity: High · Fixed in 4.6.58
  54. AdvisoryPraisonAI: `--api-key` flag on `praisonai serve` is not properly enforcedOSV · 2026-08-25 · Severity: High · Fixed in 4.6.58
  55. AdvisoryPraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secretOSV · 2026-08-25 · Severity: High · Fixed in 4.6.58
  56. AdvisoryPraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP serverOSV · 2026-08-25 · Severity: High · Fixed in 4.6.58
  57. AdvisoryPraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114OSV · 2026-08-25 · Severity: High · Fixed in 4.6.58
  58. AdvisoryPraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by defaultOSV · 2026-07-23 · Fixed in 4.6.61
  59. AdvisoryPraisonAI Code agent tools fail open without a workspace boundaryOSV · 2026-07-23 · Fixed in 4.6.59
  60. AdvisoryPraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvalsOSV · 2026-07-23 · Fixed in 4.6.59
  61. AdvisoryPraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversalOSV · 2026-07-23 · Fixed in 4.6.59
  62. AdvisoryPraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storageOSV · 2026-07-23 · Fixed in 4.6.59
  63. AdvisoryPraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletionOSV · 2026-07-23 · Fixed in 4.6.59
  64. AdvisoryPraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missingOSV · 2026-07-23 · Fixed in 4.6.59
  65. AdvisoryPraisonAI recipe serve Typer command bypasses the non-localhost authentication guardOSV · 2026-07-23 · Fixed in 4.6.59
  66. AdvisoryPraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yamlOSV · 2026-07-23 · Fixed in 4.6.61
  67. AdvisoryPraisonAI recipe.run_stream skips dangerous-tool policy enforcementOSV · 2026-07-23 · Fixed in 4.6.59
  68. AdvisoryPraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailableOSV · 2026-07-23 · Fixed in 4.6.61
  69. AdvisoryPraisonAI Slack app_mention bypasses configured user/channel authorizationOSV · 2026-07-23 · Fixed in 4.6.59
  70. AdvisoryPraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered toolsOSV · 2026-07-23 · Fixed in 4.6.59
  71. AdvisoryPraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocationOSV · 2026-07-23 · Fixed in 4.6.59
  72. AdvisoryPraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path ValidationOSV · 2026-07-23 · Fixed in 4.6.61
  73. AdvisoryPraisonAI: Compute-bridged file tools allow shell command injectionOSV · 2026-07-23 · Fixed in 4.6.59
  74. AdvisoryPraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous toolsOSV · 2026-07-23 · Fixed in 4.6.59
  75. AdvisoryPraisonAI: Jobs API exposes agent-execution endpoints with no authenticationOSV · 2026-07-23 · Fixed in 4.6.59
  76. AdvisoryPraisonAI: Jobs webhook SSRF protection bypass via DNS rebindingOSV · 2026-07-23 · Fixed in 4.6.59
  77. AdvisoryPraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisoOSV · 2026-07-23 · Fixed in 4.6.59
  78. AdvisoryPraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authenticationOSV · 2026-07-23 · Fixed in 4.6.61
  79. Advisorypraisonai: recipe serve auth middleware silently disables itself when no secret is setOSV · 2026-07-23 · Fixed in 4.6.59
  80. AdvisoryPraisonAI: Unauthenticated Local File Inclusion via agent_file path in PraisonAI Jobs APIOSV · 2026-07-23 · Fixed in 4.6.59
  81. AdvisoryPraisonAI: Unauthenticated RCE via Jobs API + Approval BypassOSV · 2026-07-23 · Fixed in 4.6.59
  82. AdvisoryPraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)OSV · 2026-07-23 · Fixed in 4.6.59
  83. AdvisoryPraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model contextOSV · 2026-07-13 · Fixed in 4.6.40
  84. AdvisoryPraisonAI has an Arbitrary File Write in Python APIOSV · 2026-07-13 · Fixed in 4.6.40
  85. AdvisoryPraisonAI Has Arbitrary File Write (Zip Slip) in Templates ExtractionOSV · 2026-07-13 · Fixed in 4.5.113
  86. AdvisoryPraisonAI Has ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools()OSV · 2026-07-13 · Fixed in 4.5.90
  87. AdvisoryPraisonAI Has Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandboxOSV · 2026-07-13 · Fixed in 4.5.97
  88. AdvisoryPraisonAI has Template Injection in Agent Tool DefinitionsOSV · 2026-07-13 · Fixed in 4.5.115
  89. AdvisoryPraisonAI has unauthenticated RCE via `tool_override.py` (CVE-2026-40287 patch bypass)OSV · 2026-07-13 · Fixed in 4.6.32
  90. AdvisoryPraisonAI Has Unauthenticated SSE Event Stream that Exposes All Agent Activity in A2U ServerOSV · 2026-07-13 · Fixed in 4.5.115
  91. AdvisoryPraisonAI has Unrestricted Upload Size in WSGI Recipe Registry Server that Enables Memory Exhaustion DoSOSV · 2026-07-13 · Fixed in 4.5.128
  92. AdvisoryPraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables executeOSV · 2026-07-13 · Fixed in 4.6.37
  93. AdvisoryPraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queriesOSV · 2026-07-13 · Fixed in 4.6.34
  94. AdvisoryPraisonAI recipe registry publish path traversal allows out-of-root file writeOSV · 2026-07-13 · Fixed in 4.5.113
  95. AdvisoryPraisonAI recipe registry pull path traversal writes files outside the chosen output directoryOSV · 2026-07-13 · Fixed in 4.5.113
  96. AdvisoryPraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow executionOSV · 2026-07-13 · Fixed in 4.6.34
  97. AdvisoryPraisonAI spider_tools SSRF protection bypass via alternate loopback host encodingsOSV · 2026-07-13 · Fixed in 4.6.40
  98. AdvisoryPraisonAI Vulnerable to Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-varsOSV · 2026-07-13 · Fixed in 4.5.128
  99. AdvisoryPraisonAI Vulnerable to Code Injection and Protection Mechanism FailureOSV · 2026-07-13 · Fixed in 4.5.128
  100. AdvisoryPraisonAI Vulnerable to Decompression Bomb DoS via Recipe Bundle Extraction Without Size LimitsOSV · 2026-07-13 · Fixed in 4.5.128
  101. AdvisoryPraisonAI Vulnerable to Implicit Execution of Arbitrary Code via Automatic `tools.py` LoadingOSV · 2026-07-13 · Fixed in 4.5.128
  102. AdvisoryPraisonAI Vulnerable to RCE via Automatic tools.py ImportOSV · 2026-07-13 · Fixed in 4.5.139
  103. AdvisoryPraisonAI Vulnerable to Sensitive Environment Variable Exposure via Untrusted MCP Subprocess ExecutionOSV · 2026-07-13 · Fixed in 4.5.128
  104. AdvisoryPraisonAI Vulnerable to Server-Side Request Forgery via Unvalidated webhook_url in Jobs APIOSV · 2026-07-13 · Fixed in 4.5.128
  105. AdvisoryPraisonAI Vulnerable to Stored XSS via Unsanitized Agent Output in HTML Rendering (nh3 Not a Required Dependency)OSV · 2026-07-13 · Fixed in 4.5.128
  106. AdvisoryPraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validateOSV · 2026-07-13 · Fixed in 4.6.40
  107. AdvisoryPraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334OSV · 2026-07-13 · Fixed in 4.6.40
  108. AdvisoryPraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)OSV · 2026-07-13 · Fixed in 4.5.149
  109. AdvisoryPraisonAI: SQLiteConversationStore didn't validate table_prefix when constructing SQL queriesOSV · 2026-07-13 · Fixed in 4.5.133
  110. AdvisoryPraisonAI: SSRF via Unvalidated api_base in passthrough() FallbackOSV · 2026-07-13 · Fixed in 4.5.90
  111. AdvisoryPraisonAI: Unauthenticated Allow-List Manipulation Bypasses Agent Tool Approval Safety ControlsOSV · 2026-07-13 · Fixed in 4.5.128
  112. AdvisoryPraisonAI: Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOSOSV · 2026-07-13 · Fixed in 4.5.128
  113. AdvisoryPraisonAI: Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate LimitsOSV · 2026-07-13 · Fixed in 4.5.128
  114. AdvisoryPraisonAI's symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`OSV · 2026-07-13 · Fixed in 4.6.37
  115. AdvisoryPraisonAI `deploy --type api` emits a Flask server with authentication disabled by defaultOSV · 2026-06-29 · Fixed in 4.6.40
  116. AdvisoryPraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessionsOSV · 2026-06-29 · Fixed in 4.5.139
  117. AdvisoryPraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unsetOSV · 2026-06-29 · Fixed in 4.6.40
  118. AdvisoryPraisonAI has an incomplete fix for CVE-2026-34935 - OS Command InjectionOSV · 2026-06-29 · Fixed in 4.5.149
  119. AdvisoryPraisonAI Has Authentication Bypass via OAuthManager.validate_token()OSV · 2026-06-29 · Fixed in 4.5.97
  120. AdvisoryPraisonAI has critical RCE via `type: job` workflow YAMLOSV · 2026-06-29 · Fixed in 4.5.139
  121. AdvisoryPraisonAI Has Missing Authentication in WebSocket GatewayOSV · 2026-06-29 · Fixed in 4.5.97
  122. AdvisoryPraisonAI Has Path Traversal in FileToolsOSV · 2026-06-29 · Fixed in 1.5.113
  123. AdvisoryPraisonAI Has Second-Order SQL Injection in `get_all_user_threads`OSV · 2026-06-29 · Fixed in 4.5.90
  124. AdvisoryPraisonAI MCP `tools/call` path-traversal => RCE via Python `.pth` injectionOSV · 2026-06-29 · Fixed in 4.6.34
  125. AdvisoryPraisonAI Vulnerable to Arbitrary File Write / Path Traversal in Action OrchestratorOSV · 2026-06-29 · Fixed in 4.5.113
  126. AdvisoryPraisonAI vulnerable to arbitrary file write via path traversal in `praisonai recipe unpack`OSV · 2026-06-29 · Fixed in 4.5.128
  127. AdvisoryPraisonAI Vulnerable to OS Command InjectionOSV · 2026-06-29 · Fixed in 4.5.121
  128. AdvisoryPraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition LoadingOSV · 2026-06-29 · Fixed in 4.5.115
  129. AdvisoryPraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)OSV · 2026-06-29 · Fixed in 4.6.40
  130. AdvisoryPraisonAI Vulnerable Untrusted Remote Template Code ExecutionOSV · 2026-06-29 · Fixed in 4.5.128
  131. AdvisoryPraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()OSV · 2026-06-29 · Fixed in 4.5.69
  132. AdvisoryPraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool executionOSV · 2026-06-29 · Fixed in 4.6.40
  133. Incidentnpm PraisonAI codeMode sandbox escape via Function constructorAgentArmorHQ incident library · 2026-06-18 · Severity: Critical · Fixed in 1.7.2
  134. IncidentPraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missingAgentArmorHQ incident library · 2026-06-18 · Severity: High · Fixed in 4.6.59
  135. IncidentPraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocationAgentArmorHQ incident library · 2026-06-18 · Severity: Critical · Fixed in 4.6.59
  136. Incidentpraisonai: Jobs API exposes agent-execution endpoints with no authenticationAgentArmorHQ incident library · 2026-06-18 · Severity: Critical · Fixed in 4.6.59
  137. IncidentPraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` ToolAgentArmorHQ incident library · 2026-06-18 · Severity: Critical · Fixed in 1.7.2
  138. IncidentUnauthenticated Remote Code Execution via Jobs API and Approval Bypass in PraisonAIAgentArmorHQ incident library · 2026-06-18 · Severity: Critical · Fixed in praisonai 4.6.59; praisonaiagents 1.6.59
  139. AdvisoryPraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by defaultOSV · 2026-06-18 · Severity: High · Fixed in 4.6.61
  140. AdvisoryPraisonAI Code agent tools fail open without a workspace boundaryOSV · 2026-06-18 · Severity: High · Fixed in 4.6.59
  141. AdvisoryPraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvalsOSV · 2026-06-18 · Severity: High · Fixed in 4.6.59
  142. AdvisoryPraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversalOSV · 2026-06-18 · Severity: High · Fixed in 4.6.59
  143. AdvisoryPraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storageOSV · 2026-06-18 · Severity: High · Fixed in 4.6.59
  144. AdvisoryPraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletionOSV · 2026-06-18 · Severity: High · Fixed in 4.6.59
  145. AdvisoryPraisonAI recipe serve Typer command bypasses the non-localhost authentication guardOSV · 2026-06-18 · Severity: High · Fixed in 4.6.59
  146. AdvisoryPraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yamlOSV · 2026-06-18 · Severity: High · Fixed in 4.6.61
  147. AdvisoryPraisonAI recipe.run_stream skips dangerous-tool policy enforcementOSV · 2026-06-18 · Severity: High · Fixed in 4.6.59
  148. AdvisoryPraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailableOSV · 2026-06-18 · Severity: High · Fixed in 4.6.61
  149. AdvisoryPraisonAI Slack app_mention bypasses configured user/channel authorizationOSV · 2026-06-18 · Severity: High · Fixed in 4.6.59
  150. AdvisoryPraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered toolsOSV · 2026-06-18 · Severity: High · Fixed in 4.6.59
  151. AdvisoryPraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path ValidationOSV · 2026-06-18 · Severity: Critical · Fixed in 4.6.61
  152. AdvisoryPraisonAI: Compute-bridged file tools allow shell command injectionOSV · 2026-06-18 · Severity: High · Fixed in 4.6.59
  153. AdvisoryPraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous toolsOSV · 2026-06-18 · Severity: High · Fixed in 4.6.59
  154. AdvisoryPraisonAI: Jobs webhook SSRF protection bypass via DNS rebindingOSV · 2026-06-18 · Severity: High · Fixed in 4.6.59
  155. AdvisoryPraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisoOSV · 2026-06-18 · Severity: Critical · Fixed in 4.6.59
  156. AdvisoryPraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authenticationOSV · 2026-06-18 · Severity: High · Fixed in 4.6.61
  157. Advisorypraisonai: recipe serve auth middleware silently disables itself when no secret is setOSV · 2026-06-18 · Severity: Critical · Fixed in 4.6.59
  158. AdvisoryPraisonAI: Unauthenticated Local File Inclusion via agent_file path in PraisonAI Jobs APIOSV · 2026-06-18 · Severity: High · Fixed in 4.6.59
  159. AdvisoryPraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)OSV · 2026-06-18 · Severity: High · Fixed in 4.6.59
  160. Incidentpraisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}AgentArmorHQ incident library · 2026-06-01 · Severity: Medium · Fixed in 0.1.4
  161. IncidentPraisonAI vulnerable to sandbox escape via print.__self__ builtins module leak in execute_code (subprocess mode)AgentArmorHQ incident library · 2026-05-29 · Severity: Critical · Fixed in 1.6.40 (praisonaiagents), 4.6.40 (PraisonAI)
  162. AdvisoryPraisonAI `deploy --type api` emits a Flask server with authentication disabled by defaultOSV · 2026-05-29 · Severity: Critical · Fixed in 4.6.40
  163. AdvisoryPraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unsetOSV · 2026-05-29 · Severity: Critical · Fixed in 4.6.40
  164. AdvisoryPraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model contextOSV · 2026-05-29 · Severity: Medium · Fixed in 4.6.40
  165. AdvisoryPraisonAI has an Arbitrary File Write in Python APIOSV · 2026-05-29 · Severity: High · Fixed in 4.6.40
  166. AdvisoryPraisonAI spider_tools SSRF protection bypass via alternate loopback host encodingsOSV · 2026-05-29 · Severity: Medium · Fixed in 4.6.40
  167. AdvisoryPraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validateOSV · 2026-05-29 · Severity: High · Fixed in 4.6.40
  168. AdvisoryPraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334OSV · 2026-05-29 · Severity: High · Fixed in 4.6.40
  169. AdvisoryPraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool executionOSV · 2026-05-29 · Severity: Critical · Fixed in 4.6.40
  170. AdvisoryPraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables executeOSV · 2026-05-11 · Severity: High · Fixed in 4.6.37
  171. AdvisoryPraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queriesOSV · 2026-05-11 · Severity: Medium · Fixed in 4.6.34
  172. AdvisoryPraisonAI MCP `tools/call` path-traversal => RCE via Python `.pth` injectionOSV · 2026-05-11 · Severity: Critical · Fixed in 4.6.34
  173. AdvisoryPraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow executionOSV · 2026-05-11 · Severity: High · Fixed in 4.6.34
  174. AdvisoryPraisonAI's symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`OSV · 2026-05-11 · Severity: High · Fixed in 4.6.37
  175. AdvisoryPraisonAI has unauthenticated RCE via `tool_override.py` (CVE-2026-40287 patch bypass)OSV · 2026-05-06 · Severity: High · Fixed in 4.6.32
  176. AdvisoryPraisonAI has an incomplete fix for CVE-2026-34935 - OS Command InjectionOSV · 2026-04-17 · Severity: Critical · Fixed in 4.5.149
  177. AdvisoryPraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)OSV · 2026-04-17 · Severity: High · Fixed in 4.5.149
  178. AdvisoryPraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessionsOSV · 2026-04-10 · Severity: Critical · Fixed in 4.5.139
  179. AdvisoryPraisonAI has critical RCE via `type: job` workflow YAMLOSV · 2026-04-10 · Severity: Critical · Fixed in 4.5.139
  180. AdvisoryPraisonAI has Unrestricted Upload Size in WSGI Recipe Registry Server that Enables Memory Exhaustion DoSOSV · 2026-04-10 · Severity: Medium · Fixed in 4.5.128
  181. AdvisoryPraisonAI vulnerable to arbitrary file write via path traversal in `praisonai recipe unpack`OSV · 2026-04-10 · Severity: Critical · Fixed in 4.5.128
  182. AdvisoryPraisonAI Vulnerable to Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-varsOSV · 2026-04-10 · Severity: High · Fixed in 4.5.128
  183. AdvisoryPraisonAI Vulnerable to Code Injection and Protection Mechanism FailureOSV · 2026-04-10 · Severity: High · Fixed in 4.5.128
  184. AdvisoryPraisonAI Vulnerable to Decompression Bomb DoS via Recipe Bundle Extraction Without Size LimitsOSV · 2026-04-10 · Severity: Medium · Fixed in 4.5.128
  185. AdvisoryPraisonAI Vulnerable to Implicit Execution of Arbitrary Code via Automatic `tools.py` LoadingOSV · 2026-04-10 · Severity: High · Fixed in 4.5.128
  186. AdvisoryPraisonAI Vulnerable to RCE via Automatic tools.py ImportOSV · 2026-04-10 · Severity: High · Fixed in 4.5.139
  187. AdvisoryPraisonAI Vulnerable to Sensitive Environment Variable Exposure via Untrusted MCP Subprocess ExecutionOSV · 2026-04-10 · Severity: Medium · Fixed in 4.5.128
  188. AdvisoryPraisonAI Vulnerable to Server-Side Request Forgery via Unvalidated webhook_url in Jobs APIOSV · 2026-04-10 · Severity: High · Fixed in 4.5.128
  189. AdvisoryPraisonAI Vulnerable to Stored XSS via Unsanitized Agent Output in HTML Rendering (nh3 Not a Required Dependency)OSV · 2026-04-10 · Severity: Medium · Fixed in 4.5.128
  190. AdvisoryPraisonAI Vulnerable Untrusted Remote Template Code ExecutionOSV · 2026-04-10 · Severity: Critical · Fixed in 4.5.128
  191. AdvisoryPraisonAI: Hardcoded `approval_mode="auto"` in Chainlit UI Overrides Administrator Configuration, Enabling Unapproved Shell Command ExecutionOSV · 2026-04-10 · Severity: High · Fixed in 4.5.128
  192. AdvisoryPraisonAI: SQLiteConversationStore didn't validate table_prefix when constructing SQL queriesOSV · 2026-04-10 · Severity: Medium · Fixed in 4.5.133
  193. AdvisoryPraisonAI: Unauthenticated Allow-List Manipulation Bypasses Agent Tool Approval Safety ControlsOSV · 2026-04-10 · Severity: High · Fixed in 4.5.128
  194. AdvisoryPraisonAI: Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOSOSV · 2026-04-10 · Severity: Medium · Fixed in 4.5.128
  195. AdvisoryPraisonAI: Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate LimitsOSV · 2026-04-10 · Severity: High · Fixed in 4.5.128
  196. AdvisoryPraisonAI has Template Injection in Agent Tool DefinitionsOSV · 2026-04-08 · Severity: High · Fixed in 4.5.115
  197. AdvisoryPraisonAI Has Unauthenticated SSE Event Stream that Exposes All Agent Activity in A2U ServerOSV · 2026-04-08 · Severity: High · Fixed in 4.5.115
  198. AdvisoryPraisonAI Vulnerable to OS Command InjectionOSV · 2026-04-08 · Severity: Critical · Fixed in 4.5.121
  199. AdvisoryPraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition LoadingOSV · 2026-04-08 · Severity: Critical · Fixed in 4.5.115
  200. AdvisoryPraisonAI Has Arbitrary File Write (Zip Slip) in Templates ExtractionOSV · 2026-04-06 · Severity: High · Fixed in 4.5.113
  201. AdvisoryPraisonAI Has Path Traversal in FileToolsOSV · 2026-04-06 · Severity: Critical · Fixed in 1.5.113
  202. AdvisoryPraisonAI recipe registry publish path traversal allows out-of-root file writeOSV · 2026-04-06 · Severity: High · Fixed in 4.5.113
  203. AdvisoryPraisonAI recipe registry pull path traversal writes files outside the chosen output directoryOSV · 2026-04-06 · Severity: High · Fixed in 4.5.113
  204. AdvisoryPraisonAI Vulnerable to Arbitrary File Write / Path Traversal in Action OrchestratorOSV · 2026-04-06 · Severity: Critical · Fixed in 4.5.113
  205. AdvisoryPraisonAI Has Authentication Bypass via OAuthManager.validate_token()OSV · 2026-04-01 · Severity: Critical · Fixed in 4.5.97
  206. AdvisoryPraisonAI Has Missing Authentication in WebSocket GatewayOSV · 2026-04-01 · Severity: Critical · Fixed in 4.5.97
  207. AdvisoryPraisonAI Has ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools()OSV · 2026-04-01 · Severity: Medium · Fixed in 4.5.90
  208. AdvisoryPraisonAI Has Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandboxOSV · 2026-04-01 · Severity: High · Fixed in 4.5.97
  209. AdvisoryPraisonAI Has Second-Order SQL Injection in `get_all_user_threads`OSV · 2026-04-01 · Severity: Critical · Fixed in 4.5.90
  210. AdvisoryPraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()OSV · 2026-04-01 · Severity: Critical · Fixed in 4.5.69
  211. AdvisoryPraisonAI: SSRF via Unvalidated api_base in passthrough() FallbackOSV · 2026-04-01 · Severity: High · Fixed in 4.5.90

Sources we read: OSV, GitHub Advisory Database, CISA Known Exploited Vulnerabilities, 44 security news feeds and our incident library. Last checked 2026-10-30.

Check a specific version →

About PraisonAI

PraisonAI is an MCP server focused on General: AI Agents Framework with Self Reflection and MCP support.

It is published on PyPI as praisonai and hosted on GitHub at MervinPraison/PraisonAI (9,286 GitHub stars, 2,538 PyPI downloads, last repository push on 2026-10-24). Based on its public metadata, it operates with standard local or API scope without broad shell execution flags noted.

Setup

Check these steps against the project’s own instructions before running anything.

Run the PyPI package praisonai in an isolated environment:

bash
uvx praisonai

See https://github.com/MervinPraison/PraisonAI (opens external site) for required environment variables.

Why this grade

BB — Some risk signals

Signal-based grade (4/7 points): very widely starred on GitHub, public source code. This reflects adoption and transparency, not a code review.

Popularity and upkeep

65/100
GitHub stars
9.3k
PyPI downloads
2.5k
Listing last refreshed
2026-10-28

These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.

Risks to watch for

  • Dependency & version pinning: Distributed via PyPI (praisonai). Pin an exact release version or commit SHA rather than floating tags so upstream updates are reviewed first.

How to lower the risk

Least-privilege permissions

  • Give it access only to the specific folders, accounts or projects it needs, never your whole drive or admin account.
  • Use a separate, limited API key or login just for this tool so you can switch it off without affecting anything else.

Network isolation

  • Run it on a work computer or sandbox account, not one holding personal or company-sensitive data.
  • If your IT team can, limit which websites and services it is allowed to contact.

Monitoring

  • Check its activity history or logs weekly at first, and look at what it changed or sent.
  • Turn on alerts for new logins or unusual usage on any account it connects to.

Red flags to watch for

  • It asks for more access than its job requires, or prompts you to paste passwords.
  • It suddenly updates with new owners, or starts contacting unfamiliar websites.

Questions

How do I install PraisonAI?

Run uvx praisonai (or pip install praisonai) in your terminal, or add the server entry to your claude_desktop_config.json or .cursor/mcp.json as shown in the Setup section on this page. Full setup docs and environment variables are in github.com/MervinPraison/PraisonAI.

Are there security reports about PraisonAI?

211 reports were found for this package in our research. Titles and dates (OSV, AgentArmorHQ incident library) are listed in the Reports section above. PraisonAI currently holds Grade B (Some risk signals) based on public adoption and transparency signals. Key risk areas to watch include dependency & version pinning:.

Is PraisonAI actively maintained?

PraisonAI has 9.3k GitHub stars and 2.5k PyPI downloads, with its latest repository commit pushed on 2026-10-24. Our directory data was last refreshed on 2026-10-28. Check recent commit activity, release tags, and open issues at github.com/MervinPraison/PraisonAI before pinning it in production.

What are alternatives to PraisonAI?

Compare PraisonAI side by side with similar MCP servers in the Related tools section on this page, or browse all MCP servers on AgentArmorHQ.

README badge and team notes

Maintain or use PraisonAI? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.

AgentArmorHQ Risk Grade B for PraisonAI

GitHub README Markdown:

markdown
[![AgentArmorHQ Risk Grade for PraisonAI](https://agentarmorhq.com/api/badge/mervinpraison-praisonai)](https://agentarmorhq.com/skills/mervinpraison-praisonai)

HTML embed:

html
<a href="https://agentarmorhq.com/skills/mervinpraison-praisonai"><img src="https://agentarmorhq.com/api/badge/mervinpraison-praisonai" alt="AgentArmorHQ Risk Grade for PraisonAI" height="20" /></a>

Terminal check:

terminal
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "mervinpraison-praisonai"

Share with your security lead

Need sign-off to use PraisonAI? Copy this note for Slack, a ticket or a pull request.

### AgentArmorHQ Security Review Memo: PraisonAI
- **Listing URL:** https://agentarmorhq.com/skills/mervinpraison-praisonai
- **Type:** App connector
- **Risk Grade:** Grade B (Some risk signals)
- **Outside Security Advisories on File:** 211
- **Public Adoption:** 9.3k GitHub stars

#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** Runs shell or system commands
- **Network reach:** Connects to outside service API
- **Credentials:** No API token required
- **Package source:** PyPI (praisonai)

#### Recommended Hardened Setup
- **Command:** `uvx praisonai`
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.

_Based on public adoption and transparency signals as of Oct 24, 2026. Our opinion, not a code audit or security guarantee._

Key facts

Type
App connector
Publisher
MervinPraison
Source code
github.com/MervinPraison/PraisonAI
Install command
pip install praisonai
Est. context load
~500 tokens / turn (~3 tool schemas, 0.25% of 200k context)
Popularity
9.3k GitHub stars, 2.5k PyPI downloads
Last updated
2026-10-28
Last graded
2026-10-24

Community

Discussions for PraisonAI

Ask questions or share configuration tips. Governed by our Community Rules & Terms.

No posts match this filter yet.

Be the first to ask a question or share a working tip.

Was this listing for PraisonAI helpful?

Check before you install, in Claude

Your assistant answers Block, Review or No known issues for any package before it installs it.

Get this check inside Claude