praisonai
PyPI107 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting praisonaipage 3 of 3
- CVE-2026-61436HIGHCVSS 8.6EG 8.6fixed in 4.6.782026-07-15
vulnerable: 0.0.1 ... 4.6.9 (763 versions)
PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated attackers to forge message.received events. Attackers can send crafted JSON payloads to the webhook endpoint to invoke conf…
- CVE-2026-61438HIGHCVSS 7.3EG 7.3fixed in 4.6.782026-07-15
vulnerable: 0.0.1 ... 4.6.9 (763 versions)
PraisonAI before 4.6.78 contains a remote code execution vulnerability in JobWorkflowExecutor._exec_inline_python() due to insufficient AST validation of workflow script steps. Attackers can create malicious YAML workflow files with import…
- CVE-2026-61439HIGHCVSS 7.5EG 7.5fixed in 4.6.782026-07-11
vulnerable: 0.0.1 ... 4.6.9 (763 versions)
PraisonAI versions before 4.6.78 contain a prompt injection defense misconfiguration where the block threshold defaults to CRITICAL severity, allowing HIGH-level threats to pass through unblocked. Attackers can submit single-vector prompt …
- CVE-2026-61444CRITICALCVSS 9.1EG 9.1fixed in 4.6.782026-07-10
vulnerable: 0.0.1 ... 4.6.9 (763 versions)
PraisonAI versions before 4.6.78 contain a code injection vulnerability in deploy/api.py where the agents_file parameter is directly interpolated into an f-string without sanitization. Attackers can inject arbitrary Python code that execut…
- CVE-2026-61445CRITICALCVSS 9.9EG 9.9fixed in 4.6.782026-07-11
vulnerable: 0.0.1 ... 4.6.9 (763 versions)
PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component due to missing path validation and command sanitization in LLM tool calls. Attackers can inject malicious prompts through …
- CVE-2026-62176CRITICALCVSS 9.1EG 9.1fixed in 4.6.782026-10-07
vulnerable: 0.0.1 ... 4.6.9 (763 versions)
PraisonAI is a multi-agent teams system. Prior to version 4.6.78, the `deploy/api.py` module generates Python server code by directly interpolating the `agents_file` parameter into an f-string that is then written to a file and executed vi…
- CVE-2026-64824HIGHCVSS 8.4EG 8.4fixed in 4.6.402026-07-21
vulnerable: 0.0.1 ... 4.6.9 (731 versions)
Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absolute filesystem paths by supplying a crafted tar archive with a SYMTYPE entry …
Check whether praisonai is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for praisonai CVEs against the assets you own.
Book a Demo →