# PraisonAI

> AI Agents Framework with Self Reflection and MCP support

- name: io.github.MervinPraison/praisonai
- version: 2.3.42
- connection class: L0 (run_local_package)
- trust: 76/100
- quality: –/100 (not scored)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.MervinPraison%2Fpraisonai
- tools: https://api.protogrid.dev/v1/servers/io.github.MervinPraison%2Fpraisonai/tools

**Runs on your machine: something must execute the package.** Only local packages are published (npm, PyPI, OCI, …). The registry never executes them, so tools are unknown until you run it.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "praisonai": {
      "command": "uvx",
      "args": [
        "praisonai==2.3.42"
      ]
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: n/a
- freshness: 45
- provenance: 80
- drivers: +repository +namespace-matches-repo ~liveness-unmeasured -stale-305d
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality –/100 (not scored)

Not scored: fewer than three checks apply, usually because no remote answered a credential-free probe or the server is a local package.

### protocol: n/a (weight 25)

- n/a `protocol.modern`, `protocol.stateless`, `protocol.transport`, `protocol.list_ttl`: no remote answered a protocol handshake (not probed yet, unreachable, or local-only)

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: n/a (weight 30)

- n/a `tools.descriptions`, `tools.description_length`, `tools.schemas`, `tools.annotations`, `tools.directory_hints`, `tools.token_cost`, `tools.api_dump`: tool list unknown (behind auth, not probed, or empty)

### stability: n/a (weight 15)

- n/a `stability.changes`, `stability.rug_pull`: tool list unknown

### dependencies: 67 (weight 15)

- fail `deps.known_vulns`: 67 advisories to act on (malicious, or rated high or critical with a fix available): GHSA-2g87-pp6c-29x5 in aiohttp@3.14.3 (indirect, fixed in 3.14.4), GHSA-5wr8-gcqf-gqf3 in aiohttp@3.14.3 (indirect, fixed in 3.14.4), GHSA-2763-cj5r-c79m in praisonai@2.3.42 (the package itself, fixed in 4.5.121), ...; 18 more of lower severity or without a fix
- pass `deps.mcp_sdk_version`: mcp 2.2.0, no known advisory
- pass `deps.resolvable`: praisonai@2.3.42 resolved: 67 packages

- tools: unknown
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.MervinPraison/praisonai.svg)](https://protogrid.dev/servers/io.github.MervinPraison/praisonai)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Dependencies

- pypi praisonai@2.3.42: resolved, 66 dependencies, MCP SDK mcp 2.2.0
  - GHSA-2763-cj5r-c79m (critical) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.5.121 ``, advisory summary: "PraisonAI Vulnerable to OS Command Injection" https://osv.dev/vulnerability/GHSA-2763-cj5r-c79m
  - GHSA-29w3-p9w9-wc47 (critical) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.61 ``, advisory summary: "PraisonAI: Arbitrary File Read/Write via \`multiedit\` Tool Without Path Validation" https://osv.dev/vulnerability/GHSA-29w3-p9w9-wc47
  - GHSA-32vr-5gcf-3pw2 (critical) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.5.115 ``, advisory summary: "PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading" https://osv.dev/vulnerability/GHSA-32vr-5gcf-3pw2
  - GHSA-4869-x4pr-q22x (critical) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.59 ``, advisory summary: "PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass" https://osv.dev/vulnerability/GHSA-4869-x4pr-q22x
  - GHSA-4mr5-g6f9-cfrh (critical) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.40 ``, advisory summary: "PraisonAI vulnerable to sandbox escape via \`print.\_\_self\_\_\` builtins module leak in \`execute\_code\` (subprocess mode)" https://osv.dev/vulnerability/GHSA-4mr5-g6f9-cfrh
  - GHSA-6g6r-q6gw-w8fg (critical) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.58 ``, advisory summary: "PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)" https://osv.dev/vulnerability/GHSA-6g6r-q6gw-w8fg
  - GHSA-8444-4fhq-fxpq (critical) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.40 ``, advisory summary: "PraisonAI \`deploy --type api\` emits a Flask server with authentication disabled by default" https://osv.dev/vulnerability/GHSA-8444-4fhq-fxpq
  - GHSA-86qc-r5v2-v6x6 (critical) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.40 ``, advisory summary: "PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL\_SERVER\_TOKEN is unset" https://osv.dev/vulnerability/GHSA-86qc-r5v2-v6x6
  - GHSA-8x8f-54wf-vv92 (critical) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.5.139 ``, advisory summary: "PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions" https://osv.dev/vulnerability/GHSA-8x8f-54wf-vv92
  - GHSA-98f9-fqg5-hvq5 (critical) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.5.97 ``, advisory summary: "PraisonAI Has Authentication Bypass via OAuthManager.validate\_token()" https://osv.dev/vulnerability/GHSA-98f9-fqg5-hvq5
  - GHSA-9cq8-3v94-434g (critical) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.5.90 ``, advisory summary: "PraisonAI Has Second-Order SQL Injection in \`get\_all\_user\_threads\`" https://osv.dev/vulnerability/GHSA-9cq8-3v94-434g
  - GHSA-9mp3-24cc-77mg (critical) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.78 ``, advisory summary: "PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls" https://osv.dev/vulnerability/GHSA-9mp3-24cc-77mg
  - GHSA-9mqq-jqxf-grvw (critical) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.34 ``, advisory summary: "PraisonAI MCP \`tools/call\` path-traversal =\> RCE via Python \`.pth\` injection" https://osv.dev/vulnerability/GHSA-9mqq-jqxf-grvw
  - GHSA-9qhq-v63v-fv3j (critical) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.5.149 ``, advisory summary: "PraisonAI has an incomplete fix for CVE-2026-34935 - OS Command Injection" https://osv.dev/vulnerability/GHSA-9qhq-v63v-fv3j
  - GHSA-cfh6-vr3j-qc3g (critical) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.5.97 ``, advisory summary: "PraisonAI Has Missing Authentication in WebSocket Gateway" https://osv.dev/vulnerability/GHSA-cfh6-vr3j-qc3g
  - GHSA-fq2m-6wqh-x44g (critical) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.59 ``, advisory summary: "PraisonAI: Jobs API exposes agent-execution endpoints with no authentication" https://osv.dev/vulnerability/GHSA-fq2m-6wqh-x44g
  - GHSA-g6j7-pffp-8whg (critical) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.78 ``, advisory summary: "PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation" https://osv.dev/vulnerability/GHSA-g6j7-pffp-8whg
  - GHSA-j4hj-7hfh-g2f4 (critical) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.59 ``, advisory summary: "praisonai: recipe serve auth middleware silently disables itself when no secret is set" https://osv.dev/vulnerability/GHSA-j4hj-7hfh-g2f4
  - GHSA-jfxc-v5g9-38xr (critical) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.5.113 ``, advisory summary: "PraisonAI Vulnerable to Arbitrary File Write / Path Traversal in Action Orchestrator" https://osv.dev/vulnerability/GHSA-jfxc-v5g9-38xr
  - GHSA-p75f-6fp4-p57w (critical) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.59 ``, advisory summary: "PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai" https://osv.dev/vulnerability/GHSA-p75f-6fp4-p57w
  - GHSA-pv9q-275h-rh7x (critical) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.5.128 ``, advisory summary: "PraisonAI Vulnerable Untrusted Remote Template Code Execution" https://osv.dev/vulnerability/GHSA-pv9q-275h-rh7x
  - GHSA-vc46-vw85-3wvm (critical) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.5.139 ``, advisory summary: "PraisonAI has critical RCE via \`type: job\` workflow YAML" https://osv.dev/vulnerability/GHSA-vc46-vw85-3wvm
  - GHSA-vg22-4gmj-prxw (critical) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.40 ``, advisory summary: "PraisonAI's unauthenticated A2A official example can reach real LLM-driven \`eval()\` tool execution" https://osv.dev/vulnerability/GHSA-vg22-4gmj-prxw
  - GHSA-2g87-pp6c-29x5 (high) in `` aiohttp@3.14.3 ``, indirect, fixed in `` 3.14.4 ``, advisory summary: "aiohttp: Multiple instances of excessive or unbounded memory/CPU use" https://osv.dev/vulnerability/GHSA-2g87-pp6c-29x5
  - GHSA-5wr8-gcqf-gqf3 (high) in `` aiohttp@3.14.3 ``, indirect, fixed in `` 3.14.4 ``, advisory summary: "aiohttp server lacks an initial request/header timeout" https://osv.dev/vulnerability/GHSA-5wr8-gcqf-gqf3
  - GHSA-2g3w-cpc4-chr4 (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.5.128 ``, advisory summary: "PraisonAI Vulnerable to Implicit Execution of Arbitrary Code via Automatic \`tools.py\` Loading" https://osv.dev/vulnerability/GHSA-2g3w-cpc4-chr4
  - GHSA-2gpf-2492-q9jh (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.78 ``, advisory summary: "PraisonAI: Call API localhost-only authentication bypass via spoofed Host header" https://osv.dev/vulnerability/GHSA-2gpf-2492-q9jh
  - GHSA-2jgc-f764-c5r2 (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.58 ``, advisory summary: "PraisonAI: \[Auth Bypass\] PraisonAI async Jobs API (\`/api/v1/runs\`) has no authentication — unauthenticated job execution, result theft, cancel and delete" https://osv.dev/vulnerability/GHSA-2jgc-f764-c5r2
  - GHSA-3c4r-6p77-xwr7 (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.5.128 ``, advisory summary: "PraisonAI Vulnerable to Code Injection and Protection Mechanism Failure" https://osv.dev/vulnerability/GHSA-3c4r-6p77-xwr7
  - GHSA-4ph2-f6pf-79wv (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.5.113 ``, advisory summary: "PraisonAI Has Arbitrary File Write (Zip Slip) in Templates Extraction" https://osv.dev/vulnerability/GHSA-4ph2-f6pf-79wv
  - GHSA-4rx4-4r3x-6534 (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.5.113 ``, advisory summary: "PraisonAI recipe registry pull path traversal writes files outside the chosen output directory" https://osv.dev/vulnerability/GHSA-4rx4-4r3x-6534
  - GHSA-4w49-gwv8-fpjg (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.78 ``, advisory summary: "PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF" https://osv.dev/vulnerability/GHSA-4w49-gwv8-fpjg
  - GHSA-4wr3-f4p3-5wjh (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.5.128 ``, advisory summary: "PraisonAI: Unauthenticated Allow-List Manipulation Bypasses Agent Tool Approval Safety Controls" https://osv.dev/vulnerability/GHSA-4wr3-f4p3-5wjh
  - GHSA-5r6c-gj4g-r697 (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.78 ``, advisory summary: "PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend" https://osv.dev/vulnerability/GHSA-5r6c-gj4g-r697
  - GHSA-78r8-wwqv-r299 (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.40 ``, advisory summary: "PraisonAI: Arbitrary code execution via unguarded \`spec.loader.exec\_module\` in \`agents\_generator.py\` - sibling of CVE-2026-44334" https://osv.dev/vulnerability/GHSA-78r8-wwqv-r299
  - GHSA-79fv-7hq9-w7xg (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.78 ``, advisory summary: "PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source" https://osv.dev/vulnerability/GHSA-79fv-7hq9-w7xg
  - GHSA-7c92-x8vg-4258 (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.78 ``, advisory summary: "PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents" https://osv.dev/vulnerability/GHSA-7c92-x8vg-4258
  - GHSA-8ccj-p46r-jwqq (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.61 ``, advisory summary: "PraisonAI: PRAISONAI\_CALL\_AUTH=disabled environment variable unconditionally disables authentication" https://osv.dev/vulnerability/GHSA-8ccj-p46r-jwqq
  - GHSA-8frj-8q3m-xhgm (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.5.128 ``, advisory summary: "PraisonAI Vulnerable to Server-Side Request Forgery via Unvalidated webhook\_url in Jobs API" https://osv.dev/vulnerability/GHSA-8frj-8q3m-xhgm
  - GHSA-9cr9-25q5-8prj (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.40 ``, advisory summary: "PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate" https://osv.dev/vulnerability/GHSA-9cr9-25q5-8prj
  - GHSA-9q28-ghcr-c4x3 (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.37 ``, advisory summary: "PraisonAI's symlink-extraction bypass of \`\_safe\_extractall\` writes outside \`dest\_dir\`" https://osv.dev/vulnerability/GHSA-9q28-ghcr-c4x3
  - GHSA-ch89-h4r2-c8f8 (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.58 ``, advisory summary: "PraisonAI: \[Path Traversal\] agent tools escape the configured workspace via symlinks" https://osv.dev/vulnerability/GHSA-ch89-h4r2-c8f8
  - GHSA-cv3g-hj65-pcfh (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.78 ``, advisory summary: "PraisonAI: Shell command allowlist bypass via find -exec built-in action" https://osv.dev/vulnerability/GHSA-cv3g-hj65-pcfh
  - GHSA-f292-66h9-fpmf (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.5.115 ``, advisory summary: "PraisonAI Has Unauthenticated SSE Event Stream that Exposes All Agent Activity in A2U Server" https://osv.dev/vulnerability/GHSA-f292-66h9-fpmf
  - GHSA-fj8f-m44g-c479 (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.78 ``, advisory summary: "PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats" https://osv.dev/vulnerability/GHSA-fj8f-m44g-c479
  - GHSA-fvxx-ggmx-3cjg (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.5.128 ``, advisory summary: "PraisonAI Vulnerable to Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars" https://osv.dev/vulnerability/GHSA-fvxx-ggmx-3cjg
  - GHSA-g985-wjh9-qxxc (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.5.139 ``, advisory summary: "PraisonAI Vulnerable to RCE via Automatic tools.py Import" https://osv.dev/vulnerability/GHSA-g985-wjh9-qxxc
  - GHSA-gcq3-mfvh-3x25 (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.59 ``, advisory summary: "PraisonAI Code agent tools fail open without a workspace boundary" https://osv.dev/vulnerability/GHSA-gcq3-mfvh-3x25
  - GHSA-gfq8-hmph-9gjv (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.58 ``, advisory summary: "PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret" https://osv.dev/vulnerability/GHSA-gfq8-hmph-9gjv
  - GHSA-gmjg-hv98-qggq (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.37 ``, advisory summary: "PraisonAI has unsafe tool resolution in \`ToolExecutionMixin.execute\_tool\`: undeclared \`\_\_main\_\_\` callables execute" https://osv.dev/vulnerability/GHSA-gmjg-hv98-qggq
  - GHSA-hc5v-gxvj-58wh (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.78 ``, advisory summary: "PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface" https://osv.dev/vulnerability/GHSA-hc5v-gxvj-58wh
  - GHSA-hvhp-v2gc-268q (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.40 ``, advisory summary: "PraisonAI has an Arbitrary File Write in Python API" https://osv.dev/vulnerability/GHSA-hvhp-v2gc-268q
  - GHSA-hwg5-x759-7wjg (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.5.115 ``, advisory summary: "PraisonAI has Template Injection in Agent Tool Definitions" https://osv.dev/vulnerability/GHSA-hwg5-x759-7wjg
  - GHSA-p4pj-vh7h-6cqh (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.59 ``, advisory summary: "PraisonAI: Unauthenticated Local File Inclusion via agent\_file path in PraisonAI Jobs API" https://osv.dev/vulnerability/GHSA-p4pj-vh7h-6cqh
  - GHSA-pvph-5j39-v8qc (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.58 ``, advisory summary: "PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server" https://osv.dev/vulnerability/GHSA-pvph-5j39-v8qc
  - GHSA-pvxx-r596-f5qj (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.58 ``, advisory summary: "PraisonAI: \`--api-key\` flag on \`praisonai serve\` is not properly enforced" https://osv.dev/vulnerability/GHSA-pvxx-r596-f5qj
  - GHSA-q5r4-47m9-5mc7 (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.5.128 ``, advisory summary: "PraisonAI: Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate Limits" https://osv.dev/vulnerability/GHSA-q5r4-47m9-5mc7
  - GHSA-qj9c-59p6-8cgx (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.78 ``, advisory summary: "PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing" https://osv.dev/vulnerability/GHSA-qj9c-59p6-8cgx
  - GHSA-qwgj-rrpj-75xm (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.5.128 ``, advisory summary: "PraisonAI: Hardcoded \`approval\_mode="auto"\` in Chainlit UI Overrides Administrator Configuration, Enabling Unapproved Shell Command Execution" https://osv.dev/vulnerability/GHSA-qwgj-rrpj-75xm
  - GHSA-r4f2-3m54-pp7q (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.5.97 ``, advisory summary: "PraisonAI Has Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandbox" https://osv.dev/vulnerability/GHSA-r4f2-3m54-pp7q
  - GHSA-r7v3-x45f-g7hp (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.58 ``, advisory summary: "PraisonAI: \[Auth Bypass\] \`praisonai serve agents --api-key\` is silently ignored — agent-invocation routes (\`POST /agents\`, \`POST /agents/{agent\_name}\`) run unauthenticated" https://osv.dev/vulnerability/GHSA-r7v3-x45f-g7hp
  - GHSA-r9x3-wx45-2v7f (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.5.113 ``, advisory summary: "PraisonAI recipe registry publish path traversal allows out-of-root file write" https://osv.dev/vulnerability/GHSA-r9x3-wx45-2v7f
  - GHSA-rg3h-x3jw-7jm5 (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.5.149 ``, advisory summary: "PraisonAI: SQL Injection via unvalidated \`table\_prefix\` in 9 conversation store backends (incomplete fix for CVE-2026-40315)" https://osv.dev/vulnerability/GHSA-rg3h-x3jw-7jm5
  - GHSA-rg5q-pp8p-f7jm (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.58 ``, advisory summary: "PraisonAI: Webhook SSRF via DNS fail-open in \`JobSubmitRequest.validate\_webhook\_url()\` — bypass of CVE-2026-40114" https://osv.dev/vulnerability/GHSA-rg5q-pp8p-f7jm
  - GHSA-x6m9-gxvr-7jpv (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.5.90 ``, advisory summary: "PraisonAI: SSRF via Unvalidated api\_base in passthrough() Fallback" https://osv.dev/vulnerability/GHSA-x6m9-gxvr-7jpv
  - GHSA-x92v-rpx6-p6cw (high) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.59 ``, advisory summary: "PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)" https://osv.dev/vulnerability/GHSA-x92v-rpx6-p6cw
  - GHSA-x462-jjpc-q4q4 (high) in `` praisonaiagents@1.7.8 ``, direct, fixed in `` 4.5.128 ``, advisory summary: "PraisonAI: Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI Endpoint" https://osv.dev/vulnerability/GHSA-x462-jjpc-q4q4
  - GHSA-2xgv-5cv2-47vv (moderate) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.5.128 ``, advisory summary: "PraisonAI has Unrestricted Upload Size in WSGI Recipe Registry Server that Enables Memory Exhaustion DoS" https://osv.dev/vulnerability/GHSA-2xgv-5cv2-47vv
  - GHSA-4r3p-w3mc-5v34 (moderate) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.78 ``, advisory summary: "PraisonAI: Prompt-injection defense blocks only when 3+ detector families fire simultaneously; realistic single-vector injections pass through unblocked" https://osv.dev/vulnerability/GHSA-4r3p-w3mc-5v34
  - GHSA-5c6w-wwfq-7qqm (moderate) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.40 ``, advisory summary: "PraisonAI spider\_tools SSRF protection bypass via alternate loopback host encodings" https://osv.dev/vulnerability/GHSA-5c6w-wwfq-7qqm
  - GHSA-5cxw-77wg-jrf3 (moderate) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.40 ``, advisory summary: "PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context" https://osv.dev/vulnerability/GHSA-5cxw-77wg-jrf3
  - GHSA-8w9j-hc3g-3g7f (moderate) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.5.90 ``, advisory summary: "PraisonAI Has ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search\_tools()" https://osv.dev/vulnerability/GHSA-8w9j-hc3g-3g7f
  - GHSA-cfg2-mxfj-j6pw (moderate) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.5.128 ``, advisory summary: "PraisonAI Vulnerable to Stored XSS via Unsanitized Agent Output in HTML Rendering (nh3 Not a Required Dependency)" https://osv.dev/vulnerability/GHSA-cfg2-mxfj-j6pw
  - GHSA-f2h6-7xfr-xm8w (moderate) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.5.128 ``, advisory summary: "PraisonAI Vulnerable to Decompression Bomb DoS via Recipe Bundle Extraction Without Size Limits" https://osv.dev/vulnerability/GHSA-f2h6-7xfr-xm8w
  - GHSA-hmfx-4v44-9qw9 (moderate) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.58 ``, advisory summary: "PraisonAI vulnerable to Server-Side Request Forgery via DNS rebinding bypass in webhook\_url validation" https://osv.dev/vulnerability/GHSA-hmfx-4v44-9qw9
  - GHSA-pj2r-f9mw-vrcq (moderate) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.5.128 ``, advisory summary: "PraisonAI Vulnerable to Sensitive Environment Variable Exposure via Untrusted MCP Subprocess Execution" https://osv.dev/vulnerability/GHSA-pj2r-f9mw-vrcq
  - GHSA-pm96-6xpr-978x (moderate) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.5.128 ``, advisory summary: "PraisonAI: Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOS" https://osv.dev/vulnerability/GHSA-pm96-6xpr-978x
  - GHSA-q7m5-3jmv-vm48 (moderate) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.78 ``, advisory summary: "PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace" https://osv.dev/vulnerability/GHSA-q7m5-3jmv-vm48
  - GHSA-wf65-4jjx-q444 (moderate) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.78 ``, advisory summary: "PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL" https://osv.dev/vulnerability/GHSA-wf65-4jjx-q444
  - GHSA-wj6g-v78p-6fx3 (moderate) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.58 ``, advisory summary: "PraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local MCP server" https://osv.dev/vulnerability/GHSA-wj6g-v78p-6fx3
  - GHSA-wv94-5qcp-6m36 (moderate) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.58 ``, advisory summary: "PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced)" https://osv.dev/vulnerability/GHSA-wv94-5qcp-6m36
  - GHSA-x783-xp3g-mqhp (moderate) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.5.133 ``, advisory summary: "PraisonAI: SQLiteConversationStore didn't validate table\_prefix when constructing SQL queries" https://osv.dev/vulnerability/GHSA-x783-xp3g-mqhp
  - GHSA-xpx6-x8c2-mw5w (moderate) in `` praisonai@2.3.42 ``, the package itself, fixed in `` 4.6.78 ``, advisory summary: "PraisonAI: Project custom command templates can read outside-workspace files into model prompts" https://osv.dev/vulnerability/GHSA-xpx6-x8c2-mw5w
  - GHSA-ffp3-3562-8cv3 (moderate) in `` praisonaiagents@1.7.8 ``, direct, fixed in `` 4.5.128 ``, advisory summary: "PraisonAI: Coarse-Grained Tool Approval Cache Bypasses Per-Invocation Consent for Shell Commands" https://osv.dev/vulnerability/GHSA-ffp3-3562-8cv3
  - GHSA-494j-54xm-rwp3 (low) in `` aiohttp@3.14.3 ``, indirect, fixed in `` 3.14.4 ``, advisory summary: "AIOHTTP: Secure attribute not enforced for shared cookie" https://osv.dev/vulnerability/GHSA-494j-54xm-rwp3

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0.

## Remotes

_none_

## Packages

- pypi praisonai@2.3.42

## Tools (0)

_none observed_