PraisonAI unauthenticated OS command injection in MCP connect endpoint

Executive brief

PraisonAI is an AI agent framework that includes a web-based user interface. A security flaw in the UI's Model Context Protocol (MCP) component allows an unauthenticated remote attacker to execute arbitrary commands on the server hosting the application. This could lead to a complete system takeover, theft of sensitive data, or disruption of services.

Technical details

An unauthenticated OS command injection vulnerability exists in PraisonAI v4.6.48 and earlier. The PraisonAI UI exposes the `/api/mcp/connect` endpoint without authentication by default. This endpoint accepts a JSON body containing 'command' and 'args' fields, which are passed directly to the StdioMCPClient to initiate a local process. Because the UI binds to all network interfaces (0.0.0.0) by default, a remote attacker can send a crafted POST request to execute arbitrary local commands with the privileges of the service user. The vulnerability is rooted in the `praisonaiui.server.api_mcp_connect` function and its interaction with the MCP stdio transport. A fix is available in version 4.6.59.

Affected products

• MervinPraison praisonai <= 4.6.48

Timeline

• 2026-06-17: disclosed
• 2026-06-18: advisory

References

• https://api.github.com/users/huslayer826
• https://github.com/huslayer826
• https://api.github.com/users/huslayer826/gists%7B/gist_id%7D
• https://api.github.com/users/huslayer826/repos
• https://avatars.githubusercontent.com/u/72045192?v=4
• https://api.github.com/users/huslayer826/events%7B/privacy%7D