# PraisonAI vulnerabilities Source: https://junglewise.ai/threats/technologies/praisonai Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/praisonai.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 43 vulnerabilities in PraisonAI: 0 in the last 7 days and 1 in the last 90 days, 16 of them critical and 0 exploited in the wild. The most recent, CVE-2026-56840, was published on 23 October 2026. 1 vulnerability in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 1 - All time: 43 (16 critical, 0 exploited in the wild) ## About PraisonAI An AI agents framework that combines AutoGen, CrewAI, and other multi-agent systems into a low-code solution. ## Latest PraisonAI vulnerabilities - [CVE-2026-56840: PraisonAI HTTPApproval dashboard XSS and auto-approval](https://junglewise.ai/threats/cve-2026-56840-praisonai-httpapproval-dashboard-renders-tool-arguments-as-raw) (high, CVSS 8.8, published 23 Oct 2026) - [CVE-2026-47397: PraisonAI arbitrary file write via path traversal in write_file tool](https://junglewise.ai/threats/cve-2026-47397-praisonai-arbitrary-file-write-via-path-traversal-in-write-file) (high, CVSS 4, published 21 Jul 2026) - [PraisonAI tool approval cache bypass in shell command execution](https://junglewise.ai/threats/praisonai-tool-approval-cache-bypass-in-shell-command-execution-2123e935) (medium, CVSS 5.5, published 19 Jun 2026) - [CVE-2026-44339: PraisonAI unsafe tool resolution in ToolExecutionMixin](https://junglewise.ai/threats/cve-2026-44339-praisonai-unsafe-tool-resolution-in-toolexecutionmixin) (high, CVSS 8.6, published 8 May 2026) - [CVE-2026-44336: MervinPraison PraisonAI path traversal and RCE in MCP server](https://junglewise.ai/threats/cve-2026-44336-mervinpraison-praisonai-path-traversal-and-rce-in-mcp-server) (critical, CVSS 9.6, published 8 May 2026) - [CVE-2026-44334: PraisonAI is a multi-agent teams system. From version 4.5.139 to before version 4.6.32, 's fix gated tools.py auto-import…](https://junglewise.ai/threats/cve-2026-44334-mervinpraison-praisonai-unauthenticated-rce-in-tool-override-py) (high, CVSS 8.4, published 8 May 2026) - [CVE-2026-41497: PraisonAI has an incomplete fix for - OS Command Injection](https://junglewise.ai/threats/cve-2026-41497-praisonai-has-an-incomplete-fix-for-os-command-injection) (critical, CVSS 9.8, published 8 May 2026) - [CVE-2026-41496: PraisonAI is a multi-agent teams system. Prior to praisonai version 4.6.9 and praisonaiagents version 1.6.9, the fix for…](https://junglewise.ai/threats/cve-2026-41496-praisonai-sql-injection-via-unvalidated-table-prefix-in-9) (high, CVSS 8.1, published 8 May 2026) - [CVE-2026-40315: PraisonAI SQL injection in SQLiteConversationStore table_prefix](https://junglewise.ai/threats/cve-2026-40315-praisonai-sql-injection-in-sqliteconversationstore-table-prefix) (critical, CVSS 9.8, published 14 Apr 2026) - [CVE-2026-40313: PraisonAI is a multi-agent teams system. In versions 4.5.139 and below, the GitHub Actions workflows are vulnerable to…](https://junglewise.ai/threats/cve-2026-40313-praisonai-is-a-multi-agent-teams-system-in-versions-4-5-139-and) (critical, CVSS 9.1, published 14 Apr 2026) - [CVE-2026-40289: PraisonAI Browser Server session hijacking via unauthenticated WebSocket](https://junglewise.ai/threats/cve-2026-40289-praisonai-browser-server-session-hijacking-via-unauthenticated) (critical, CVSS 9.1, published 14 Apr 2026) - [CVE-2026-40288: MervinPraison PraisonAI RCE via job workflow YAML](https://junglewise.ai/threats/cve-2026-40288-mervinpraison-praisonai-rce-via-job-workflow-yaml) (critical, CVSS 9.8, published 14 Apr 2026) - [CVE-2026-40287: PraisonAI remote code execution via automatic tools.py import](https://junglewise.ai/threats/cve-2026-40287-praisonai-remote-code-execution-via-automatic-tools-py-import) (high, CVSS 8.4, published 14 Apr 2026) - [CVE-2026-40159: MervinPraison PraisonAI sensitive information exposure in MCP integration](https://junglewise.ai/threats/cve-2026-40159-mervinpraison-praisonai-sensitive-information-exposure-in-mcp) (medium, CVSS 5.5, published 10 Apr 2026) - [CVE-2026-40158: PraisonAI Python sandbox escape via type.__getattribute__](https://junglewise.ai/threats/cve-2026-40158-praisonai-python-sandbox-escape-via-type-getattribute) (high, CVSS 8.6, published 10 Apr 2026) - [CVE-2026-40157: MervinPraison PraisonAI path traversal in recipe CLI](https://junglewise.ai/threats/cve-2026-40157-mervinpraison-praisonai-path-traversal-in-recipe-cli) (critical, CVSS 8.8, published 10 Apr 2026) - [CVE-2026-40156: PraisonAI arbitrary code execution via automatic tools.py loading](https://junglewise.ai/threats/cve-2026-40156-praisonai-arbitrary-code-execution-via-automatic-tools-py-loading) (high, CVSS 7.8, published 10 Apr 2026) - [CVE-2026-40154: MervinPraison PraisonAI remote code execution via untrusted templates](https://junglewise.ai/threats/cve-2026-40154-mervinpraison-praisonai-remote-code-execution-via-untrusted) (critical, CVSS 9.3, published 9 Apr 2026) - [CVE-2026-40151: PraisonAI AgentOS unauthenticated information disclosure in /api/agents](https://junglewise.ai/threats/cve-2026-40151-praisonai-agentos-unauthenticated-information-disclosure-in-api) (medium, CVSS 5.3, published 9 Apr 2026) - [CVE-2026-40149: PraisonAI unauthenticated allowlist manipulation in tool approval system](https://junglewise.ai/threats/cve-2026-40149-praisonai-unauthenticated-allowlist-manipulation-in-tool-approval) (high, CVSS 7.9, published 9 Apr 2026) - [CVE-2026-40148: PraisonAI decompression bomb in recipe registry extraction](https://junglewise.ai/threats/cve-2026-40148-praisonai-decompression-bomb-in-recipe-registry-extraction) (medium, CVSS 6.5, published 9 Apr 2026) - [CVE-2026-40116: PraisonAI unauthenticated WebSocket proxy in call module](https://junglewise.ai/threats/cve-2026-40116-praisonai-unauthenticated-websocket-proxy-in-call-module) (high, CVSS 7.5, published 9 Apr 2026) - [CVE-2026-40115: PraisonAI has Unrestricted Upload Size in WSGI Recipe Registry Server that Enables Memory Exhaustion DoS](https://junglewise.ai/threats/cve-2026-40115-praisonai-has-unrestricted-upload-size-in-wsgi-recipe-registry) (medium, CVSS 6.2, published 9 Apr 2026) - [CVE-2026-40114: PraisonAI SSRF in Jobs API webhook_url](https://junglewise.ai/threats/cve-2026-40114-praisonai-ssrf-in-jobs-api-webhook-url) (high, CVSS 7.2, published 9 Apr 2026) - [CVE-2026-40113: PraisonAI argument injection in Cloud Run deployment](https://junglewise.ai/threats/cve-2026-40113-praisonai-argument-injection-in-cloud-run-deployment) (high, CVSS 8.4, published 9 Apr 2026) ## Most severe PraisonAI vulnerabilities - [CVE-2026-39888: PraisonAI sandbox escape via frame traversal in execute_code](https://junglewise.ai/threats/cve-2026-39888-praisonai-sandbox-escape-via-frame-traversal-in-execute-code) (critical, CVSS 9.9, published 8 Apr 2026) - [CVE-2026-34935: MervinPraison PraisonAI OS command injection in MCPHandler](https://junglewise.ai/threats/cve-2026-34935-mervinpraison-praisonai-os-command-injection-in-mcphandler) (critical, CVSS 9.8, published 3 Apr 2026) - [CVE-2026-39890: MervinPraison PraisonAI RCE via YAML deserialization in AgentService](https://junglewise.ai/threats/cve-2026-39890-mervinpraison-praisonai-rce-via-yaml-deserialization-in) (critical, CVSS 9.8, published 8 Apr 2026) - [CVE-2026-40288: MervinPraison PraisonAI RCE via job workflow YAML](https://junglewise.ai/threats/cve-2026-40288-mervinpraison-praisonai-rce-via-job-workflow-yaml) (critical, CVSS 9.8, published 14 Apr 2026) - [CVE-2026-34934: MervinPraison PraisonAI SQL injection in get_all_user_threads](https://junglewise.ai/threats/cve-2026-34934-mervinpraison-praisonai-sql-injection-in-get-all-user-threads) (critical, CVSS 9.8, published 3 Apr 2026) - [CVE-2026-41497: PraisonAI has an incomplete fix for - OS Command Injection](https://junglewise.ai/threats/cve-2026-41497-praisonai-has-an-incomplete-fix-for-os-command-injection) (critical, CVSS 9.8, published 8 May 2026) - [CVE-2026-40315: PraisonAI SQL injection in SQLiteConversationStore table_prefix](https://junglewise.ai/threats/cve-2026-40315-praisonai-sql-injection-in-sqliteconversationstore-table-prefix) (critical, CVSS 9.8, published 14 Apr 2026) - [CVE-2026-44336: MervinPraison PraisonAI path traversal and RCE in MCP server](https://junglewise.ai/threats/cve-2026-44336-mervinpraison-praisonai-path-traversal-and-rce-in-mcp-server) (critical, CVSS 9.6, published 8 May 2026) - [CVE-2026-40088: MervinPraison PraisonAI OS command injection in execute_command](https://junglewise.ai/threats/cve-2026-40088-mervinpraison-praisonai-os-command-injection-in-execute-command) (critical, CVSS 9.6, published 9 Apr 2026) - [CVE-2026-40154: MervinPraison PraisonAI remote code execution via untrusted templates](https://junglewise.ai/threats/cve-2026-40154-mervinpraison-praisonai-remote-code-execution-via-untrusted) (critical, CVSS 9.3, published 9 Apr 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Praison technologies - [Praisonaiagents](https://junglewise.ai/threats/technologies/praisonaiagents): 19 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "PraisonAI vulnerabilities", https://junglewise.ai/threats/technologies/praisonai, 9 November 2026.