Executive brief
PraisonAI is an AI agent framework that includes a browser bridge for automating web tasks. A security flaw in the browser server component allows unauthorized users on the network to take control of active browser automation sessions. An attacker could use this to perform actions in a user's browser or steal sensitive information from open web pages without needing any login credentials.
Technical details
The PraisonAI Browser Server's WebSocket endpoint (/ws) fails to validate the 'Origin' header if it is omitted by the client, allowing non-browser clients to connect without authentication. Additionally, the server binds to 0.0.0.0 by default, exposing the bridge to the network. An attacker can connect as a 'controller', send a 'start_session' message, and the server will automatically route this request to the first available idle browser extension connection. This enables the attacker to execute arbitrary automation commands and receive the resulting data stream (actions and status) from the hijacked session. The vulnerability was patched in PraisonAI version 4.5.139 and praisonaiagents version 1.5.140.
Affected products
- MervinPraison PraisonAI <= 4.5.138
- MervinPraison praisonaiagents <= 1.5.139
Timeline
- 2026-04-10: advisory: GHSA-8x8f-54wf-vv92 published
- 2026-04-10: patched: Fixes released in PraisonAI 4.5.139 and praisonaiagents 1.5.140