Praison develops a narrowly scoped but prominently deployed suite of AI automation and agent orchestration tools centered on PraisonAI and PraisonAI Agents. Vulnerabilities affecting the vendor skew strongly toward critical-severity outcomes and cluster in input-handling and code-execution pathways, with recurring weakness classes including path traversal, code injection, OS command injection, server-side request forgery, and SQL injection that reflect the runtime and data-integration demands of dynamic agent systems. These weakness classes are particularly consequential in an agent-execution context where untrusted input flows directly into system commands, file operations, and database queries, amplifying both the severity and the breadth of impact from each flaw. Defenders should treat this vendor's security advisories as high-priority for any deployment in multi-tenant or internet-exposed environments and apply input validation and execution sandboxing appropriate to the elevated critical-severity trend. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Praison over time
Signals from CVEs in this vendor scope (53 CVEs).
53 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-44338HIGH PraisonAI is a multi-agent teams system. From version 2.5.6 to before version 4.6.34, PraisonAI ships a legacy Flask API server with authentication disabled by default. When that s | May 8, 2026 | 7.3 | 63 | NO | YES |
CVE-2026-44336CRITICAL PraisonAI is a multi-agent teams system. Prior to version 4.6.34, PraisonAI's MCP (Model Context Protocol) server (praisonai mcp serve) registers four file-handling tools by defaul | May 8, 2026 | 9.6 | 38 | NO | NO |
CVE-2026-44335CRITICAL PraisonAI is a multi-agent teams system. Prior to version 1.6.32, the URL checking logic in PraisonAI has a logical flaw that could be bypassed by attackers, leading to SSRF attack | May 8, 2026 | 9.8 | 37 | NO | NO |
CVE-2026-41497CRITICAL PraisonAI is a multi-agent teams system. Prior to version 4.6.9, the fix for PraisonAI's MCP command handling does not add a command allowlist or argument validation to parse_mcp_c | May 8, 2026 | 9.8 | 37 | NO | NO |
CVE-2026-34955CRITICAL PraisonAI is a multi-agent teams system. Prior to version 4.5.97, SubprocessSandbox in all modes (BASIC, STRICT, NETWORK_ISOLATED) calls subprocess.run() with shell=True and relies | Apr 4, 2026 | 10.0 | 37 | NO | NO |
CVE-2026-40315CRITICAL PraisonAI is a multi-agent teams system. Prior to 4.5.133, there is an SQL identifier injection vulnerability in SQLiteConversationStore where the table_prefix configuration value | Apr 14, 2026 | 9.8 | 36 | NO | NO |
CVE-2026-40114CRITICAL PraisonAI is a multi-agent teams system. Prior to 4.5.128, the /api/v1/runs endpoint accepts an arbitrary webhook_url in the request body with no URL validation. When a submitted j | Apr 9, 2026 | 10.0 | 35 | NO | NO |
CVE-2026-34938CRITICAL PraisonAI is a multi-agent teams system. Prior to version 1.5.90, execute_code() in praisonai-agents runs attacker-controlled Python inside a three-layer sandbox that can be fully | Apr 3, 2026 | 10.0 | 35 | NO | NO |
CVE-2026-34937CRITICAL PraisonAI is a multi-agent teams system. Prior to version 1.5.90, run_python() in praisonai constructs a shell command string by interpolating user-controlled code into python3 -c | Apr 3, 2026 | 9.8 | 35 | NO | NO |
CVE-2026-44334HIGH PraisonAI is a multi-agent teams system. From version 4.5.139 to before version 4.6.32, CVE-2026-40287's fix gated tools.py auto-import behind PRAISONAI_ALLOW_LOCAL_TOOLS=true in t | May 8, 2026 | 8.4 | 34 | NO | NO |
Signals from CVEs in this vendor scope (53 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Praison.
Media articles that mention a CVE ID that affects a product developed by Praison — matched by CVE ID, not by vendor name.