Executive brief
PraisonAI, an AI agent framework, is vulnerable to a security flaw where malicious content processed by an AI agent can execute unauthorized code in a user's web browser. This occurs because the application's web interface fails to properly clean data received from external sources like web scraping or user prompts. An attacker could exploit this to steal user session information, hijack accounts, or perform unauthorized actions on behalf of users viewing the AI's output.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in PraisonAI's Flask API endpoint (`src/praisonai/api.py`) due to improper neutralization of input during HTML generation. The application attempts to use the `nh3` library for sanitization, but because `nh3` is not a required dependency, the code silently falls back to a no-op function that returns raw HTML. Furthermore, the `home()` route uses f-strings to embed Markdown-converted output directly into the response, bypassing Flask's Jinja2 auto-escaping. An attacker can exploit this by poisoning data sources (RAG, web scraping, or prompt injection) to inject malicious `<script>` tags or event handlers. The vulnerability is patched in version 4.5.128.
Affected products
- MervinPraison PraisonAI < 4.5.128
Timeline
- 2026-04-09: disclosed
- 2026-04-09: patched: Version 4.5.128 released
- 2026-04-10: advisory