Executive brief
PraisonAI's npm package ships a multi-agent framework with an HTTP server that listens on all network interfaces by default and exposes sensitive agent APIs without requiring authentication. An attacker with network access can read agent names, roles, and instruction details, and invoke agents to execute tasks without any credentials. This could allow unauthorized access to business data, external APIs, and system resources that deployed agents can reach.
Technical details
The npm praisonai package implements a TypeScript-based AgentOS HTTP server that binds to 0.0.0.0 by default and exposes sensitive routes via Express.js without authentication middleware. The GET /api/agents endpoint discloses agent names, roles, and instruction prefixes, while the POST /api/chat endpoint allows direct agent invocation with user-supplied messages. The root cause is the absence of authentication and authorization middleware between request parsing and route registration; AgentOSConfig lacks any authentication token or authorization callback configuration. An unauthenticated network attacker can enumerate agents and execute prompt injection attacks through /api/chat to influence agent behavior and access downstream systems, credentials, and business data accessible to the deployed agents. The vulnerability is patched in version 1.7.2 and later by adding bearer-token authentication middleware.
Affected products
- PraisonAI AgentOS >=1.6.0, <=1.7.1
Timeline
- 2026-06-18: disclosed
- 2026-06-17: patched: Patched in version 1.7.2+