Executive brief
PraisonAI's browser automation server validates Chrome extension connections using a flawed regex pattern that fails to enforce exact string length, allowing an attacker to bypass origin verification via a malformed header. Once connected, an attacker can command the server to execute arbitrary browser automation tasks on the victim's machine, including stealing session cookies, capturing screenshots, or manipulating any authenticated web application the user is logged into.
Technical details
The vulnerability exists in `praisonai/browser/server.py` line 186, where WebSocket connection origin validation uses `re.match(r"chrome-extension://[a-z0-9]{32}", origin)`. The `re.match()` function only anchors at the start of the string, not the end; any origin header with 33+ characters after the scheme (e.g., `chrome-extension://aaa...aaa`) passes the check. The vulnerable code has no other authentication mechanism—no bearer tokens, API keys, or extension ID allowlists. After connection, an attacker can send `start_session` messages with arbitrary `goal` and `model` parameters, which are broadcast to all connected Chrome extensions and executed as browser automation commands. This is a patch bypass of GHSA-8x8f-54wf-vv92 (CVE-2026-40289), which added the regex check but failed to properly anchor it. On default localhost binding, local attackers or compromised dependencies can exploit this; with `PRAISONAI_BROWSER_ALLOW_REMOTE=true`, any remote attacker can bypass authentication entirely.
Affected products
- MervinPraison PraisonAI < 4.6.58
Timeline
- 2026-08-25: disclosed: Published in GitHub Advisory Database
- 2026-08-25: patched: Fixed in version 4.6.58