praisonai

## Summary The AgentOS server in the `praisonai` TypeScript/npm package ships an insecure default: it binds `0.0.0.0`, sets no API key, and uses CORS `*` with credentials. The API-key middleware is only registered when an API key is configured, so the documented quickstart (`new AgentOS({agents:[...]}).serve({port})`) exposes, **unauthenticated**, `GET /api/agents` (which leaks agent names/roles/instructions, i.e. system prompts) and `POST /api/chat` (which invokes agents). Any network peer can read agent system prompts and drive the agent. Runtime-confirmed; severity High. ## Details ### A

CVE: CVE-2026-61426

### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6wjp-v33h-5cvq. This link is maintained to preserve external references. ### Original Description PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key requirement and wildcard CORS. Unauthenticated attackers can call GET /api/agents to read agent instructions and system prompts, or POST /api/chat to invoke agents without authentication.

## Summary The published npm package `praisonai` exports an `MCPSecurity` helper described in source as: ```text MCP Security - Authentication, authorization, and rate limiting Provides security policies for MCP servers. ``` Its `AuthMethod` type advertises five authentication methods: ```ts export type AuthMethod = 'none' | 'api-key' | 'bearer' | 'basic' | 'oauth'; ``` The authentication-policy evaluator, however, only validates credentials for `api-key` and `bearer`: ```ts if (policy.auth.method === 'api-key' || policy.auth.method === 'bearer') { const valid = policy.auth.validate

CVE: CVE-2026-57134

## Summary The published npm package `praisonai` ships `dist/tools/utility-tools.js`, which exports a `shell(command)` helper described in source as: ```text Execute shell command (safe version - read-only commands) ``` The helper attempts to enforce a safe read-only command allowlist by checking only the first whitespace-delimited token: ```ts const safeCommands = ['ls', 'cat', 'head', 'tail', 'wc', 'grep', 'find', 'echo', 'date', 'pwd', 'which']; const firstWord = command.split(/\s+/)[0]; if (!safeCommands.includes(firstWord)) { return { success: false, error: `Command not allowed:

CVE: CVE-2026-57133

## Summary The published npm package `praisonai` ships a TypeScript `AgentOS` HTTP server that defaults to `host: "0.0.0.0"` and registers sensitive agent routes without any authentication or authorization middleware. When a developer starts `AgentOS`, a network attacker who can reach the service can: - read configured agent names, roles, and the first 100 characters of each agent's instructions through `GET /api/agents`; and - invoke the selected agent through `POST /api/chat` without credentials. This is distinct from the existing Python/PyPI AgentOS and API-server advisories. The affect

CVE: CVE-2026-57140

## Summary The published npm package `praisonai` exports a TypeScript `SandboxExecutor` with a `network-isolated` mode. The CLI lists that mode as: ```text network-isolated No network access (proxy blocked) ``` The implementation does not create a network namespace, firewall rule, socket filter, or proxy-enforced execution boundary. It only injects proxy environment variables into the child process: ```ts http_proxy: 'http://localhost:0', https_proxy: 'http://localhost:0', HTTP_PROXY: 'http://localhost:0', HTTPS_PROXY: 'http://localhost:0', no_proxy: '', NO_PROXY: '' ``` Clients that do

CVE: CVE-2026-57135

## Summary The published npm package `praisonai` exports `createAgentLoop()`, whose `onToolCall` callback is documented and exampled as an approval hook. The implementation calls PraisonAI's `generateText()` wrapper with the caller's executable tools first, receives `toolResults`, and only then calls `onToolCall()`. Because AI SDK `generateText()` executes tools with an `execute` function as part of the generation call, `onToolCall` can deny a tool only after the sensitive side effect has already happened. PraisonAI then returns `finishReason: "tool_rejected"`, which is a false security sign

CVE: CVE-2026-57137

## Summary The published npm package `praisonai` exports a TypeScript `MCPServer` that can expose tools, resources, and prompts over an HTTP JSON-RPC transport with: ```ts await server.start({ port: 3000 }); ``` The HTTP transport has no authentication or authorization path. `MCPServerConfig` does not expose an auth/security setting, `startHttp()` ignores the `Authorization` header, and every POST request is parsed and forwarded directly to `handleRequest()`. That request handler dispatches sensitive MCP methods such as `tools/call`, `resources/read`, and `prompts/get`. The implementation

CVE: CVE-2026-57139

## Summary The `codeMode` tool in `src/praisonai-ts/src/tools/builtins/code-mode.ts` uses `new Function()` with a `with(sandbox)` pattern to execute LLM-generated code. The blocklist-based "sandbox" can be trivially bypassed via `Function('return this')()` to recover the global object, followed by `global.require()` with string concatenation to evade the blocklist regex. This allows full arbitrary code execution on the host system. This affects all deployments where the code-mode tool is enabled for agents. ## Details **Vulnerable code (lines 187–191):** ```typescript const fn = new Function(

CVE: CVE-2026-57141

## Summary The published npm package `praisonai` exports `SandboxExecutor`, `CommandValidator`, and `sandboxExec` as "safe command execution with restrictions." When `allowedCommands` is configured, `CommandValidator` checks only the first whitespace-delimited token of the command string. `SandboxExecutor` then passes the entire original string to `spawn("sh", ["-c", command])`. With a policy that allows only `echo`, this direct command is correctly rejected: ```sh cat /tmp/marker ``` but this chained command is accepted and executed: ```sh echo allowed; cat /tmp/marker ``` The shell exe

CVE: CVE-2026-57136