Executive brief
PraisonAI's model control protocol (MCP) HTTP server performs insufficient validation of web browser origins when accepting tool execution requests. An attacker can craft a malicious webpage with a specially crafted origin header (like `http://localhost.evil.example`) that bypasses the localhost allowlist and triggers file read or state modification operations on a victim's local machine running an unauthenticated MCP server. By default, the server listens only on localhost and has no authentication enabled, making this a browser-mediated attack vector.
Technical details
The vulnerability exists in the origin validation logic of `HTTPStreamTransport` in `src/praisonai/praisonai/mcp_server/transports/http_stream.py`. When `allowed_origins` is not explicitly configured and the server binds to localhost (127.0.0.1), the code creates a default allowlist including `http://localhost` and `http://127.0.0.1`. The validation function then accepts any origin that starts with an allowlisted value using a simple `startswith()` check, rather than requiring an exact match. Combined with the default lack of API key authentication and automatic registration of dangerous tools like `praisonai.files.create` (which can read arbitrary files) and `praisonai.todo.add` (which modifies local state), an attacker-controlled webpage can bypass the origin check and invoke these tools with attacker-supplied arguments. The default server binds to 127.0.0.1 with no authentication, so exploitation requires browser-mediated access (victim visits attacker's webpage) or DNS rebinding. Patch 4.6.58 corrects the origin validation to use exact matching and proper URL parsing.
Affected products
- MervinPraison PraisonAI < 4.6.58
Timeline
- 2026-06-13: disclosed: Published in GitHub Advisory Database
- 2026-06-13: patched: Patch available as version 4.6.58
- 2026-08-25: advisory: Advisory updated with additional details