pkg:npm/praisonai

All known vulnerabilities

• CRITICAL9.9CVE-2026-57138npm PraisonAI codeMode sandbox escape via Function constructor
  >= 1.4.0, < 1.7.2
• CRITICAL9.8CVE-2026-57139npm PraisonAI MCPServer exposes unauthenticated HTTP tools/call
  >= 1.5.0, < 1.7.2
• CRITICAL9.8CVE-2026-57141PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool
  from 0, < 1.7.2
• CRITICAL9.4npm PraisonAI AgentOS exposes unauthenticated agent listing and invocation
  >= 1.6.0, < 1.7.2
• HIGH8.8npm PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining
  >= 1.5.1, < 1.7.2
• HIGH8.8npm PraisonAI AgentLoop onToolCall approval runs after tool execution
  >= 1.4.0, < 1.7.2
• HIGH8.8npm PraisonAI SandboxExecutor allowedCommands bypass via shell chaining
  >= 1.2.3, < 1.7.2
• HIGH8.2npm PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation
  >= 1.5.1, < 1.7.2
• HIGH7.6npm PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients
  >= 1.2.3, < 1.7.2