Security: MervinPraison/PraisonAI
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
npm Package: MCPServer Exposes Unauthenticated HTTP tools/callGHSA-j4f3-55x4-r6q2 published
Jun 17, 2026 by MervinPraisonCritical -
npm Package: codeMode Sandbox Escape via Function ConstructorGHSA-vmmj-pfw7-fjwp published
Jun 17, 2026 by MervinPraisonCritical -
npm Package: AgentOS Exposes Unauthenticated Agent Listing and InvocationGHSA-9752-mhqh-h34f published
Jun 17, 2026 by MervinPraisonCritical -
Slack app_mention Bypasses Configured User/Channel AuthorizationGHSA-qvpf-j64c-jmhr published
Jun 17, 2026 by MervinPraisonHigh -
Recipe Serve Typer Command Bypasses Non-Localhost Authentication GuardGHSA-5qw8-f2g9-ff29 published
Jun 17, 2026 by MervinPraisonHigh -
ToolsMCPServer Legacy SSE Transport Accepts Attacker Host/Origin and Exposes Registered ToolsGHSA-vmf9-xx9w-86wx published
Jun 17, 2026 by MervinPraisonHigh -
SandlockSandbox Falls Back to Unrestricted Subprocess Execution When Landlock Is UnavailableGHSA-6jcq-6546-qrrw published
Jun 17, 2026 by MervinPraisonHigh -
LinearBot Processes Unsigned Webhooks When LINEAR_WEBHOOK_SECRET Is MissingGHSA-fc26-m9pf-v56q published
Jun 17, 2026 by MervinPraisonHigh -
recipe.run_stream Skips Dangerous-Tool Policy EnforcementGHSA-v847-hxxw-3pxg published
Jun 17, 2026 by MervinPraisonHigh -
Recipe Workflow Policy Bypass via YAML-Approved Dangerous Tools Outside TEMPLATE.yamlGHSA-7qw2-w5rc-37x2 published
Jun 17, 2026 by MervinPraisonHigh