Vulnerabilidades en mervinpraison
178 resultadosCVE-2026-47413CRITICALpraisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/membersEPSS 0.3%CVE-2026-61440HIGHPraisonAI Platform before 0.1.9 Authorization Bypass via Label EndpointsEPSS 0.3%CVE-2026-60085HIGHPraisonAI before 4.6.78 Unenforced Security Policy in Subprocess SandboxEPSS 0.3%CVE-2026-61430HIGHPraisonAI before 1.6.78 DNS Rebinding SSRF via web_crawlEPSS 0.3%CVE-2026-57128MEDIUMPraisonAI: Unauthenticated Event Injection via SSE `/publish` EndpointEPSS 0.3%CVE-2026-40148MEDIUMPraisonAI Affected by Decompression Bomb DoS via Recipe Bundle Extraction Without Size LimitsEPSS 0.3%CVE-2026-40287HIGHPraisonAI has RCE via Automatic tools.py ImportEPSS 0.2%CVE-2026-44334HIGHPraisonAI: Unauthenticated RCE via `tool_override.py`EPSS 0.2%CVE-2026-55524HIGHPraisonAI: SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap)EPSS 0.2%CVE-2026-40158HIGHPraisonAI has Improper Control of Generation of Code ('Code Injection') and Protection Mechanism Failure in praisonaiEPSS 0.2%CVE-2026-57142HIGHPraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yamlEPSS 0.2%CVE-2026-40114HIGHPraisonAI has Server-Side Request Forgery via Unvalidated webhook_url in Jobs APIEPSS 0.2%CVE-2026-40111CRITICALPraisonAIAgents has an OS Command Injection via shell=True in Memory Hooks Executor (memory/hooks.py)EPSS 0.2%CVE-2026-40149HIGHPraisonAI has an Unauthenticated Allow-List Manipulation Bypasses Agent Tool Approval Safety ControlsEPSS 0.2%CVE-2026-40113HIGHPraisonAI has an Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-varsEPSS 0.2%CVE-2026-40112MEDIUMPraisonAI has Stored XSS via Unsanitized Agent Output in HTML Rendering (nh3 Not a Required Dependency)EPSS 0.2%CVE-2026-55522HIGHPraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe codeEPSS 0.2%CVE-2026-57112HIGHPraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered toolsEPSS 0.2%CVE-2026-60091MEDIUMPraisonAI before 4.6.78 Unauthenticated SSRF via webhook_urlEPSS 0.2%CVE-2026-60088MEDIUMPraisonAI before 4.6.78 Path Traversal via Custom CommandsEPSS 0.2%