MervinPraison PraisonAI cross-origin agent execution in AGUI endpoint

Executive brief

PraisonAI is a framework for building and running AI agents. A security flaw in its web interface allows malicious websites to silently execute commands on a user's local AI server if it is running. This could allow an attacker to steal sensitive files, access environment variables, or perform unauthorized actions with the agent's tools without the user's knowledge.

Technical details

The AGUI endpoint (`POST /agui`) in `praisonaiagents` lacks authentication and implements a hardcoded `Access-Control-Allow-Origin: *` header. Because the underlying Starlette/FastAPI framework parses JSON bodies regardless of the `Content-Type` header, an attacker can use a 'simple request' (e.g., `text/plain`) to bypass CORS preflight checks. This allows a malicious website to send arbitrary prompts to a locally running AGUI server. The wildcard CORS header then permits the attacker's site to read the agent's response, leading to data exfiltration and remote tool execution. The issue is fixed in version 4.5.128.

Affected products

• MervinPraison praisonaiagents < 4.5.128

Timeline

• 2026-04-09: patched: Version 4.5.128 released
• 2026-04-10: advisory: GitHub Advisory GHSA-x462-jjpc-q4q4 published

References

• https://api.github.com/users/offset
• https://github.com/offset
• https://api.github.com/users/offset/gists%7B/gist_id%7D
• https://api.github.com/users/offset/repos
• https://avatars.githubusercontent.com/u/114768995?v=4
• https://api.github.com/users/offset/events%7B/privacy%7D