Executive brief
The PraisonAI npm package contains a component that allows AI models to interact with external tools and data. A security flaw in this component allows anyone on the network to access and execute these tools without any password or authentication. Depending on how the software is configured, an attacker could potentially read sensitive files, execute commands, or access private data by triggering these tools remotely.
Technical details
The `MCPServer` implementation in `praisonai` (TypeScript version) exposes an HTTP JSON-RPC transport that lacks authentication and authorization checks. Specifically, the `startHttp()` method ignores the `Authorization` header and forwards all POST requests directly to `handleRequest()`, which dispatches sensitive Model Context Protocol (MCP) methods like `tools/call`, `resources/read`, and `prompts/get`. Additionally, the server binds to the unspecified address (`::` or `0.0.0.0`) by default, making it reachable over the network. While a `MCPSecurity` manager exists in the codebase, it is not integrated into the `MCPServer` request path. Attackers can list and invoke any registered server-side tools, which often include filesystem or shell access, without credentials.
Affected products
- MervinPraison praisonai (npm) >= 1.5.0, <= 1.7.1
Timeline
- 2026-06-17: disclosed
- 2026-06-17: advisory: GHSA-j4f3-55x4-r6q2 published
- 1.7.2: patched