# MervinPraison vulnerabilities Source: https://junglewise.ai/threats/vendors/mervinpraison Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/mervinpraison.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 66 vulnerabilities in MervinPraison: 0 in the last 7 days and 17 in the last 90 days, 14 of them critical and 0 exploited in the wild. The most recent, CVE-2026-57146, was published on 23 October 2026. 13 vulnerabilities in the last four weeks, up 1200% on the four before (1). 0 critical against 1. 3 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 12 - Last 90 days: 17 - All time: 66 (14 critical, 0 exploited in the wild) ## About MervinPraison Mervin Praison is an independent software developer and content creator focused on artificial intelligence and automation tools. ## Latest MervinPraison vulnerabilities - [CVE-2026-57146: PraisonAI authentication bypass in A2U event streaming](https://junglewise.ai/threats/cve-2026-57146-praisonai-a2u-incomplete-authentication-fix-leaves-current-serve) (high, CVSS 7.5, published 23 Oct 2026) - [CVE-2026-57144: PraisonAI sandbox escape when Landlock unavailable](https://junglewise.ai/threats/cve-2026-57144-praisonai-sandlocksandbox-falls-back-to-unrestricted-subprocess) (high, CVSS 8.8, published 23 Oct 2026) - [CVE-2026-57142: PraisonAI recipe policy bypass via YAML-approved tools](https://junglewise.ai/threats/cve-2026-57142-praisonai-recipe-workflow-policy-can-be-bypassed-by-declaring-and) (high, CVSS 7.8, published 23 Oct 2026) - [CVE-2026-57121: PraisonAI missing authorization check on DELETE endpoints](https://junglewise.ai/threats/cve-2026-57121-praisonai-missing-ownership-check-on-delete-endpoints-allows) (high, CVSS 8.1, published 23 Oct 2026) - [CVE-2026-57117: PraisonAI shell command injection in compute-bridged file tools](https://junglewise.ai/threats/cve-2026-57117-praisonai-compute-bridged-file-tools-allow-shell-command) (high, CVSS 8.8, published 23 Oct 2026) - [CVE-2026-57114: PraisonAI Jobs webhook SSRF via DNS rebinding](https://junglewise.ai/threats/cve-2026-57114-praisonai-jobs-webhook-ssrf-protection-bypass-via-dns-rebinding) (high, CVSS 7.2, published 23 Oct 2026) - [CVE-2026-56838: PraisonAI recipe streaming bypasses dangerous tool policy check](https://junglewise.ai/threats/cve-2026-56838-praisonai-recipe-run-stream-skips-dangerous-tool-policy) (high, CVSS 7.8, published 23 Oct 2026) - [CVE-2026-56837: PraisonAI LinearBot missing webhook signature verification](https://junglewise.ai/threats/cve-2026-56837-praisonai-linearbot-processes-unsigned-webhooks-when-linear) (high, CVSS 8.6, published 23 Oct 2026) - [CVE-2026-56836: PraisonAI authentication bypass in Recipe Serve command](https://junglewise.ai/threats/cve-2026-56836-praisonai-recipe-serve-typer-command-bypasses-the-non-localhost) (high, CVSS 8.2, published 23 Oct 2026) - [CVE-2026-56835: PraisonAI authorization bypass in Slack app_mention handler](https://junglewise.ai/threats/cve-2026-56835-praisonai-slack-app-mention-bypasses-configured-user-channel) (high, CVSS 8.3, published 23 Oct 2026) - [CVE-2026-56834: PraisonAI arbitrary file read in artifact tools](https://junglewise.ai/threats/cve-2026-56834-praisonai-dynamic-context-artifact-tools-read-arbitrary-host) (high, CVSS 7.5, published 23 Oct 2026) - [CVE-2026-56832: PraisonAI DiscordApproval dangerous tool authorization bypass](https://junglewise.ai/threats/cve-2026-56832-praisonai-discordapproval-accepts-unrelated-channel-messages-as) (high, CVSS 8.8, published 23 Oct 2026) - [CVE-2026-57143: PraisonAI SearxNG URL validation bypass in search tools](https://junglewise.ai/threats/cve-2026-57143-praisonai-server-side-request-forgery-ssrf-in-searxng-search-web) (high, CVSS 8.8, published 12 Oct 2026) - [CVE-2026-62176: PraisonAI code injection in deploy API server generation](https://junglewise.ai/threats/cve-2026-62176-praisonai-code-injection-via-f-string-interpolation-in-deploy-api) (critical, CVSS 9.1, published 7 Oct 2026) - [CVE-2026-55528: PraisonAI AgentServer authentication bypass on all routes](https://junglewise.ai/threats/cve-2026-55528-praisonai-agentserver-authentication-bypass-on-all-routes) (high, CVSS 8.2, published 25 Aug 2026) - [CVE-2026-55526: PraisonAI SSRF protection bypass in spider_tools via DNS resolution](https://junglewise.ai/threats/cve-2026-55526-praisonai-ssrf-protection-bypass-in-spider-tools-via-dns) (high, CVSS 8.5, published 25 Aug 2026) - [CVE-2026-55524: PraisonAI Agents SSRF in web_crawl tool via redirect and DNS rebinding](https://junglewise.ai/threats/cve-2026-55524-praisonai-agents-ssrf-in-web-crawl-tool-via-redirect-and-dns) (high, CVSS 7.5, published 25 Aug 2026) - [CVE-2026-47392: MervinPraison PraisonAI sandbox escape in execute_code tool](https://junglewise.ai/threats/cve-2026-47392-mervinpraison-praisonai-sandbox-escape-in-execute-code-tool) (critical, CVSS 9.9, published 21 Jul 2026) - [CVE-2026-47390: PraisonAI SSRF protection bypass in spider_tools via loopback encodings](https://junglewise.ai/threats/cve-2026-47390-praisonai-ssrf-protection-bypass-in-spider-tools-via-loopback) (medium, CVSS 5.5, published 21 Jul 2026) - [CVE-2026-61443: MervinPraison PraisonAI remote code execution in SkillTools](https://junglewise.ai/threats/cve-2026-61443-mervinpraison-praisonai-remote-code-execution-in-skilltools) (high, CVSS 8.1, published 15 Jul 2026) - [CVE-2026-61438: MervinPraison PraisonAI remote code execution in JobWorkflowExecutor](https://junglewise.ai/threats/cve-2026-61438-mervinpraison-praisonai-remote-code-execution-in) (high, CVSS 7.3, published 15 Jul 2026) - [CVE-2026-61436: MervinPraison PraisonAI missing webhook signature verification in AgentMail](https://junglewise.ai/threats/cve-2026-61436-mervinpraison-praisonai-missing-webhook-signature-verification-in) (high, CVSS 8.6, published 15 Jul 2026) - [CVE-2026-61435: MervinPraison PraisonAI auth bypass in Call API agent invocation](https://junglewise.ai/threats/cve-2026-61435-mervinpraison-praisonai-auth-bypass-in-call-api-agent-invocation) (high, CVSS 8.2, published 15 Jul 2026) - [CVE-2026-61433: MervinPraison PraisonAI code injection in API deployment generator](https://junglewise.ai/threats/cve-2026-61433-mervinpraison-praisonai-code-injection-in-api-deployment) (high, CVSS 7.8, published 15 Jul 2026) - [CVE-2026-61427: MervinPraison PraisonAI authentication bypass in MCP HTTP-stream transport](https://junglewise.ai/threats/cve-2026-61427-mervinpraison-praisonai-authentication-bypass-in-mcp-http-stream) (high, CVSS 7.3, published 15 Jul 2026) ## Most severe MervinPraison vulnerabilities - [CVE-2026-61447: MervinPraison PraisonAI remote code execution in CodeAgent](https://junglewise.ai/threats/cve-2026-61447-mervinpraison-praisonai-remote-code-execution-in-codeagent) (critical, CVSS 10, published 11 Jul 2026) - [CVE-2026-47392: MervinPraison PraisonAI sandbox escape in execute_code tool](https://junglewise.ai/threats/cve-2026-47392-mervinpraison-praisonai-sandbox-escape-in-execute-code-tool) (critical, CVSS 9.9, published 21 Jul 2026) - [CVE-2026-61445: MervinPraison PraisonAI arbitrary file write and command execution in AICoder](https://junglewise.ai/threats/cve-2026-61445-mervinpraison-praisonai-arbitrary-file-write-and-command) (critical, CVSS 9.9, published 11 Jul 2026) - [CVE-2026-39888: PraisonAI sandbox escape via frame traversal in execute_code](https://junglewise.ai/threats/cve-2026-39888-praisonai-sandbox-escape-via-frame-traversal-in-execute-code) (critical, CVSS 9.9, published 8 Apr 2026) - [CVE-2026-60090: MervinPraison PraisonAI SQL and CQL injection in knowledge-store backends](https://junglewise.ai/threats/cve-2026-60090-mervinpraison-praisonai-sql-and-cql-injection-in-knowledge-store) (critical, CVSS 9.8, published 11 Jul 2026) - [CVE-2026-40288: MervinPraison PraisonAI RCE via job workflow YAML](https://junglewise.ai/threats/cve-2026-40288-mervinpraison-praisonai-rce-via-job-workflow-yaml) (critical, CVSS 9.8, published 14 Apr 2026) - [CVE-2026-44335: MervinPraison PraisonAI SSRF bypass in URL validation](https://junglewise.ai/threats/cve-2026-44335-mervinpraison-praisonai-ssrf-bypass-in-url-validation) (critical, CVSS 9.8, published 8 May 2026) - [CVE-2026-40315: PraisonAI SQL injection in SQLiteConversationStore table_prefix](https://junglewise.ai/threats/cve-2026-40315-praisonai-sql-injection-in-sqliteconversationstore-table-prefix) (critical, CVSS 9.8, published 14 Apr 2026) - [CVE-2026-40088: MervinPraison PraisonAI OS command injection in execute_command](https://junglewise.ai/threats/cve-2026-40088-mervinpraison-praisonai-os-command-injection-in-execute-command) (critical, CVSS 9.6, published 9 Apr 2026) - [CVE-2026-40154: MervinPraison PraisonAI remote code execution via untrusted templates](https://junglewise.ai/threats/cve-2026-40154-mervinpraison-praisonai-remote-code-execution-via-untrusted) (critical, CVSS 9.3, published 9 Apr 2026) ## Vulnerabilities per week 13 vulnerabilities in the last four weeks, up 1200% on the four before (1). 0 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 3 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 1 | 1 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 12 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## MervinPraison technologies - [MervinPraison PraisonAI](https://junglewise.ai/threats/technologies/mervinpraison-praisonai): 46 vulnerabilities - [MervinPraison PraisonAI Agents](https://junglewise.ai/threats/technologies/praisonai-agents): 17 vulnerabilities - [MervinPraison Praisonaiagents](https://junglewise.ai/threats/technologies/mervinpraison-praisonaiagents): 11 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "MervinPraison vulnerabilities", https://junglewise.ai/threats/vendors/mervinpraison, 12 November 2026.