Reserved but Public CVEs

CVE-2026-57139 is an improper authentication vulnerability in the npm package praisonai affecting its TypeScript MCPServer HTTP JSON-RPC interface. The exposed HTTP transport does not enforce authentication or authorization before dispatching sensitive MCP methods, allowing unauthenticated clients to invoke operations such as tools/call, resources/read, and prompts/get. As a result, any reachable client can interact with registered server-side tools and access exposed resources or prompts without credentials. The severity and downstream effect depend on which handlers are registered behind the MCP interface, but the flaw can expose privileged application functionality directly over the network.

CVE-2026-57139First seen Jul 21, 2026

CVE-2026-57143 is a server-side request forgery vulnerability in the PraisonAI praisonaiagents package. The issue affects the SearxNG/search_web tooling by allowing attacker-controlled input for the searxng_url parameter, causing the application to issue server-side requests to arbitrary destinations. Because the response is returned to the agent, the flaw can be used not only to reach unintended internal resources but also to retrieve data from reachable internal HTTP-based services, including JSON APIs and cloud metadata services where accessible.

CVE-2026-57143First seen Jul 21, 2026

CVE-2026-57130 is an IMAP command injection vulnerability in the email-capable tools of PraisonAI Agents. User- or LLM-controlled parameters are interpolated into IMAP SEARCH and related IMAP command contexts without proper sanitization or safe encoding, allowing crafted input to break out of the intended argument structure and inject arbitrary IMAP commands. Affected parameters include fields such as sender, subject, query, search identifiers, and message identifiers used by functions including email search, reply, and archive operations. The flaw stems from constructing IMAP commands with quoted user-controlled strings instead of safely escaping embedded characters or using IMAP literal syntax. Successful exploitation can let an attacker manipulate the IMAP session and perform unintended mailbox operations beyond the original tool action.

CVE-2026-57130First seen Jul 21, 2026

CVE-2026-57135 is a sandbox isolation flaw in the PraisonAI npm package `praisonai` affecting SandboxExecutor's `network-isolated` mode. The mode is advertised as preventing network access, but it does not enforce network isolation at the operating-system level. Instead, the protection can be bypassed by network clients that do not honor proxy-based restrictions. As a result, commands executed inside the sandbox may still establish outbound or local network connections despite the expected no-network boundary. The issue is a security-control failure rather than a memory-corruption bug, and it undermines assumptions that sandboxed execution is isolated from external or internal network resources.

CVE-2026-57135First seen Jul 21, 2026

CVE-2026-57120 is a sandbox bypass vulnerability in the PraisonAI Python package praisonaiagents, affecting the execute_code functionality when used in sandbox mode. The sandbox’s blocklist-based restrictions on sensitive Python dunder attributes can be bypassed through runtime string assembly combined with Python str.format attribute resolution at the C level. This allows access to attributes that were intended to be denied, including interpreter and object metadata such as __class__, __qualname__, __bases__, __base__, __globals__, and __dict__. The issue undermines the intended isolation model by permitting untrusted code to read restricted internal attributes despite sandbox enforcement.

CVE-2026-57120First seen Jul 21, 2026

CVE-2026-56835 is an authorization bypass vulnerability in the PraisonAI Slack integration’s app_mention event handler. The flaw allows Slack app mention events to invoke the configured agent without enforcing the same authorization controls applied elsewhere, specifically bypassing configured allowed user restrictions, allowed channel restrictions, and unknown-user deny policy handling. As a result, prompt text supplied through an app_mention event can reach the agent even when the deployment is intended to restrict access to trusted users or channels only.

CVE-2026-56835First seen Jul 21, 2026

CVE-2026-57142 is a policy enforcement bypass in PraisonAI recipe workflows. An attacker can declare tools and corresponding approval entries in workflow YAML outside the expected TEMPLATE.yaml policy boundary, allowing a recipe to self-authorize use of tools that are intended to be denied by default. In particular, the flaw allows bypass of dangerous-tool restrictions and enables use of high-risk functionality such as shell command execution without requiring the expected dangerous-tools setting to be enabled. The issue stems from insufficient normalization and validation of the effective workflow tool graph during policy checks, causing workflow-level declarations and approvals to evade recipe-level enforcement.

CVE-2026-57142First seen Jul 21, 2026

CVE-2026-56836 is an authentication bypass in PraisonAI affecting the deprecated `recipe serve` Typer command. The vulnerable command path can bind the Recipe HTTP server to a non-localhost interface without enabling authentication, bypassing the intended safeguard that should prevent unauthenticated exposure when listening on non-local interfaces. As a result, deployments started through this deprecated handler may expose recipe API functionality remotely without access controls that operators would reasonably expect to be enforced.

CVE-2026-56836First seen Jul 21, 2026

CVE-2026-57132 is an authentication bypass vulnerability in PraisonAI affecting the /api/v1/agents/{id}/invoke endpoint. When the PRAISONAI_CALL_AUTH environment variable is set to disabled, authentication for agent invocation is unconditionally turned off, allowing requests to reach the endpoint without credential validation. This creates a direct access control failure on a sensitive API operation that can trigger execution of registered agents and their configured capabilities.

CVE-2026-57132First seen Jul 21, 2026

CVE-2026-56833 is a path traversal vulnerability in PraisonAI Dynamic Context history and terminal tooling. The affected functionality uses caller-controlled identifiers such as run_id and agent_id in filesystem path construction for history and terminal read, search, and export operations. Insufficient validation and containment enforcement allows an attacker to supply absolute paths or traversal sequences that resolve outside the configured storage base directory. As a result, the vulnerable code can access reachable .jsonl and .log files beyond the intended storage scope, including files associated with conversation history and terminal activity.

CVE-2026-56833First seen Jul 21, 2026

CVE-2026-57117 is a shell command injection vulnerability in PraisonAI compute-bridged file tooling. The issue affects file operations exposed through read_file, list_files, and write_file when used by LocalManagedAgent or SandboxedAgent with an attached compute provider. Attacker-controlled path arguments are incorporated into shell command execution during compute-bridged file handling, allowing untrusted input to alter the intended command. In the case of write_file, content handling may also be unsafe if treated as shell source rather than inert data. The flaw stems from constructing shell command strings from user-influenced arguments instead of using provider-native file APIs or structured argument passing. Successful exploitation can result in arbitrary command execution in local compute environments or within Docker-backed compute containers.

CVE-2026-57117First seen Jul 21, 2026

CVE-2026-57209 is a header injection vulnerability in Heimdall when operating in proxy mode. The flaw is caused by unsanitized use of the incoming Host header while constructing the outbound Forwarded header for upstream services. By supplying a crafted Host header, an attacker can inject additional parameters into the generated Forwarded header, causing upstream applications or intermediaries to consume attacker-controlled forwarding metadata. This can undermine trust assumptions about client origin information propagated through Heimdall.

CVE-2026-57209First seen Jul 21, 2026

CVE-2026-57115 is a server-side request forgery vulnerability in SpiderTools within PraisonAI. The flaw arises because the initial user-influenced URL is subjected to SSRF validation, but subsequent HTTP redirect destinations are followed automatically without applying the same validation logic to each redirect hop. As a result, an attacker can supply a benign external URL that responds with a redirect to an otherwise blocked destination, bypassing protections intended to prevent access to loopback, private-network, and metadata endpoints. The issue affects URL-processing functionality exposed through SpiderTools methods including scrape_page(), extract_links(), crawl(), and extract_text().

CVE-2026-57115First seen Jul 21, 2026

CVE-2026-56840 is a cross-site scripting vulnerability in the PraisonAI HTTPApproval dashboard. The dashboard renders tool arguments and related approval-page fields as raw HTML without sufficient output encoding, allowing attacker-controlled content to be interpreted as active script in a reviewer’s browser. If an attacker can influence agent task or prompt content such that malicious payloads are embedded into tool arguments or other rendered approval metadata, opening the approval page triggers script execution in the dashboard’s origin. This undermines the intended human-in-the-loop approval workflow by allowing injected JavaScript to interact with the approval interface directly.

CVE-2026-56840First seen Jul 21, 2026

CVE-2026-57114 is a server-side request forgery vulnerability in PraisonAI affecting the Jobs webhook feature. The issue arises from insufficient validation of attacker-supplied webhook_url values: destination checks can be bypassed at send time through DNS rebinding, allowing a hostname that initially appears benign to resolve to prohibited internal destinations when the outbound request is actually made. As a result, PraisonAI can be induced to send POST requests to loopback, private-network, or cloud metadata endpoints. The flaw is specifically a protection-bypass condition in SSRF defenses rather than a generic outbound request feature misuse.

CVE-2026-57114First seen Jul 21, 2026

CVE-2026-57129 is an arbitrary file read vulnerability in the PraisonAI praisonaiagents package affecting MentionsParser handling of @file: mentions. The flaw allows path traversal and absolute-path access outside the intended workspace boundary. When attacker-controlled input is processed as a file mention, the parser can resolve paths that escape workspace_path and read files accessible to the service account. The issue stems from insufficient path validation and unsafe path resolution logic, including acceptance of absolute paths and traversal sequences without enforcing that the final resolved path remains confined to the workspace.

CVE-2026-57129First seen Jul 21, 2026

CVE-2026-56839 is a fail-open workspace boundary vulnerability in PraisonAI Code agent-compatible CODE_TOOLS wrappers. When applications expose file-oriented tools before calling set_workspace(), the wrappers do not enforce the intended workspace restriction and permit access to paths outside the expected project boundary. Affected operations include file read and file modification capabilities exposed through code-oriented tooling such as file reading, search-and-replace, and diff application functions. The flaw allows prompt-influenced tool use to escape the intended workspace and operate on arbitrary existing files on the host.

CVE-2026-56839First seen Jul 21, 2026

CVE-2026-57141 is a remote code execution vulnerability in PraisonAI's codeMode tool. The issue stems from an insecure sandbox design that executes attacker-influenced JavaScript using new Function() together with a with(sandbox) execution model and a regex-based blocklist intended to restrict dangerous behavior. This approach is bypassable and does not provide effective isolation, allowing untrusted code to escape the intended sandbox boundary and execute in the host Node.js environment. Successful exploitation can result in arbitrary code execution on the underlying system.

CVE-2026-57141First seen Jul 21, 2026

CVE-2026-54567 is an extension validation bypass in Flask-Reuploaded affecting the UploadSet.save(storage, name=...) code path when an overridden filename is supplied through the name parameter. The flaw stems from case-folding asymmetry in validation of the overridden basename extension: denylist checks can be performed inconsistently with respect to letter case, allowing dangerous extensions in mixed-case forms to evade policy enforcement. As a result, files with extensions that should be blocked can be accepted and stored when the attacker can influence the overridden filename. This issue is described as an incomplete-fix variant of CVE-2026-27641.

CVE-2026-54567First seen Jul 18, 2026

CVE-2026-54546 is an authenticated server-side request forgery vulnerability in the CloudTAK basemap import endpoint. The issue affects the API path used to import basemap data, where user-controlled URL input is fetched by the server without sufficient destination validation. Because the server performs the outbound request on behalf of the user and returns the fetched response content, the flaw is a full-read SSRF rather than a blind SSRF. The vulnerable behavior stems from unsafe URL fetching logic that does not adequately restrict access to internal or otherwise sensitive network locations and does not sufficiently validate redirect targets across request chains.

CVE-2026-54546First seen Jul 18, 2026

CVE-2026-54247 is a denial-of-service vulnerability in Skipper's Kubernetes admission webhook handler caused by reading request bodies without an enforced size limit. A client able to reach the admission webhook and authenticate with a valid Kubernetes client certificate can submit an excessively large admission request body, leading the handler to consume unbounded memory while processing the request. The flaw affects admission control handling for Kubernetes Ingress and RouteGroup resources and can cause the Skipper process to be terminated by the operating system due to memory exhaustion.

CVE-2026-54247First seen Jul 18, 2026

CVE-2026-53496 is a denial-of-service vulnerability in ExifReader before version 4.40.1 affecting its HEIC/AVIF ISO-BMFF parsing logic. When parsing a crafted truncated image, the parser can perform out-of-bounds DataView reads while processing BMFF box structures, including extended-size fields, full-box version fields, and nested sub-box traversal. This can result in an uncaught RangeError being thrown during ExifReader.load() processing. Applications that ingest untrusted HEIC or AVIF content and do not defensively handle parser exceptions may terminate the active request, job, or worker handling the file.

CVE-2026-53496First seen Jul 18, 2026

CVE-2026-54547 is an authentication bypass vulnerability in meta-ads-mcp. In affected versions, the request authentication logic for the streamable HTTP MCP interface can incorrectly treat the presence of an X-Pipeboard-Token header as sufficient for access, allowing requests to be accepted without the required auth_token. When the server is configured with the operator's Meta access token, unauthenticated callers can cause MCP tool invocations to execute in the security context of that operator against the Meta Ads and Graph APIs.

CVE-2026-54547First seen Jul 18, 2026

CVE-2026-54549 is a server-side request forgery vulnerability in meta-ads-mcp affecting versions prior to 1.0.115. The flaw is present in the upload_ad_image functionality, which fetches attacker-controlled image_url values before meaningful credential validation occurs. When the server is deployed with the supported streamable-http transport, this behavior allows a remote requester to induce the application to make arbitrary outbound HTTP requests to attacker-selected destinations, including localhost, private internal address space, cloud metadata services, and targets reached through redirect chains. The issue stems from insufficient restriction and validation of server-initiated requests to user-supplied URLs.

CVE-2026-54549First seen Jul 18, 2026

CVE-2026-55177 is an authenticated server-side request forgery vulnerability in CloudTAK affecting the ESRI-related API routes exposed under /api/esri*. The flaw arises because attacker-controlled URLs are fetched by the server without adequate IP or DNS safety validation, allowing a user with valid authentication to direct the application to make outbound requests to arbitrary destinations. The vulnerable behavior permits access not only to external hosts but also to internal, loopback, link-local, and cloud metadata-service addresses. Because the server returns the fetched content to the requester, this is a full-read SSRF condition rather than a blind SSRF issue.

CVE-2026-55177First seen Jul 18, 2026