Four security flaws disclosed in PraisonAI agent framework

Four security advisories covering the PraisonAI agent framework were published on 8 October 2026, describing flaws that allow unauthenticated access to agent tools, arbitrary file writes and command execution, a shell allowlist bypass, and privilege escalation inside the PraisonAI platform product. All four advisories list the affected packages as the Python praisonai or praisonai-platform distributions.

The first advisory, CVE-2026-61427, concerns PraisonAI's MCP server. MCP, the Model Context Protocol, is the interface agents use to discover and call tools. According to the advisory, the HTTP-stream transport only checks an Authorization header when an API key has been configured, and the command-line interface defaults the --api-key option to none. Running praisonai mcp serve --transport http-stream therefore exposes the full tool surface without authentication. The researcher reported that an unauthenticated request could complete an initialize call and then enumerate roughly 50 tools via tools/list. The dispatcher also forwards tool-call arguments to handlers without checking them against the tool's advertised schema. The advisory stresses scope limits: two workflow tools that might have allowed remote code execution were runtime-refuted in version 4.6.63 because the adapter errors before executing anything. It rates severity as medium to high, and notes the server binds to 127.0.0.1 by default.

The second advisory, CVE-2026-61445, covers the AICoder user interface component. According to the report, AICoder exposes write_to_file and execute_command tools to the language model with no path validation and no command sanitisation. Because os.path.join does not block absolute paths, a file path supplied by the model can land anywhere on the filesystem. The advisory gives examples of prompt injection through the chat interface causing writes to cron directories or SSH key files, and says Docker containers run as root with no USER directive, increasing the impact.

The third advisory, CVE-2026-61434, describes a bypass of shell hardening that PraisonAI added in npm 1.7.2 and Python 4.6.58 to fix two earlier chaining issues. Those fixes block shell metacharacters and spawn processes with the shell disabled. But find remains on the safe-command allowlist, and find has built-in execution actions such as -exec, -execdir and -delete that run programs without any shell metacharacters. The advisory says the batch terminator + sidesteps the blocked semicolon, and that the same gap appears in four parallel implementations across the TypeScript and Python codebases. Demonstrated effects include reading files that sandbox path rules were meant to block, deleting files, and triggering commands not on the allowlist. The report notes that shell substitution is still blocked, so the bypass is limited to binaries already on disk. Suggested fixes are to remove find from the allowlists or to reject its execution flags.

The fourth advisory, CVE-2026-61442, affects praisonai-platform. According to the report, PATCH routes for projects, issues and agents require only workspace membership, while the paired delete routes enforce owner or admin permissions. An ordinary member can patch a project's lead_id to their own user id and then delete an owner-created project that they could not delete moments earlier. Test output included in the advisory shows a 403 for the direct delete, then a 204 after the ownership field was rewritten. Members could also rewrite owner-created issue titles and agent instructions.