Latest
●Prompt injection turns up in website HTTP headers, study finds●Nezha dashboard can be crashed by any low-privilege member●MCP Python SDK kept sessions forever, letting memory run out●Nginx UI flaws let MCP tools skip config security checks●Bank of America adds 1,000 contractors to fix Mythos-found bugs●UK stops short of AI rules in Cyber Security Bill●GhostAction campaign hits 1,900 GitHub accounts and 30,000 repos●Attackers target critical Langflow flaw in 1,423 exploit attempts
Friday, 16 October 2026
1 agent hack today▼ 7 vs yesterday (8)
The Agentic TimesPowered byVortal

Incident database

PraisonAI: Multiple Critical Security Vulnerabilities

PraisonAI contains four distinct security vulnerabilities across its platform and core components: unauthenticated MCP HTTP-stream exposure, arbitrary file write/command execution via AICoder, shell command allowlist bypass using find -exec, and privilege escalation through PATCH route authorization bypass. These enable unauthorized tool access, code execution, privilege escalation, and resource manipulation.

Disclosed 8 October 2026 · Record updated 9 October 2026

Impact

Four separate vulnerabilities enable: (1) unauthenticated access to MCP tools by default, (2) arbitrary file write and command execution via prompt injection in AICoder, (3) shell command allowlist bypass using find -exec, and (4) privilege escalation allowing workspace members to patch and delete owner-created resources across the platform.

Our coverage

Sources

  1. github.comhttps://github.com/advisories/GHSA-hc5v-gxvj-58wh
  2. github.comhttps://github.com/advisories/GHSA-9mp3-24cc-77mg
  3. github.comhttps://github.com/advisories/GHSA-cv3g-hj65-pcfh
  4. github.comhttps://github.com/advisories/GHSA-c78w-2q4r-68r7