Vulnerabilities in mervinpraison
178 resultsCVE-2026-44338HIGHPraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow executionEPSS 32.6%CVE-2026-61447CRITICALPraisonAI before 1.6.78 Remote Code Execution via CodeAgentEPSS 15.2%CVE-2026-34938CRITICALPraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_codeEPSS 13.4%CVE-2026-48168CRITICALPraisonAI: GitHub Actions Claude workflow command injection via unquoted PR branch nameEPSS 1.5%CVE-2026-47391CRITICALPraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool executionEPSS 1.5%CVE-2026-57124CRITICALPraisonAI UI MCP connect endpoint allows unauthenticated local command executionEPSS 1.0%CVE-2026-57131CRITICALpraisonai: Jobs API exposes agent-execution endpoints with no authenticationEPSS 1.0%CVE-2026-57123CRITICALPraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired inEPSS 0.9%CVE-2026-57127CRITICALpraisonai: recipe serve auth middleware silently disables itself when no secret is setEPSS 0.9%CVE-2026-47392CRITICALPraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)EPSS 0.9%CVE-2026-34935CRITICALPraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()EPSS 0.8%CVE-2026-57133HIGHPraisonAI utility shell safe-command wrapper allowlist bypass via shell chainingEPSS 0.8%CVE-2026-57147CRITICALpraisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgeryEPSS 0.8%CVE-2026-40151MEDIUMPraisonAI Affected by Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOSEPSS 0.8%CVE-2026-57139CRITICALPraisonAI MCPServer exposes unauthenticated HTTP tools/callEPSS 0.8%CVE-2026-57141CRITICALPraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` ToolEPSS 0.7%CVE-2026-57138CRITICALPraisonAI codeMode sandbox escape via Function constructorEPSS 0.7%CVE-2026-61434HIGHPraisonAI before 4.6.78 Allowlist Bypass via find -execEPSS 0.7%CVE-2026-60090CRITICALPraisonAI before 4.6.78 SQL/CQL Injection via vector dimensionEPSS 0.7%CVE-2026-57140CRITICALPraisonAI AgentOS exposes unauthenticated agent listing and invocationEPSS 0.6%