https://cvebrief.com/archive/cves/vendor/mervinpraison/ High and critical MervinPraison vulnerabilities covered by CVE Brief, with independent analyst commentary. en-us Wed, 16 Sep 2026 12:00:00 GMT https://cvebrief.com/cve/cve-2026-57138/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-57138 Wed, 16 Sep 2026 12:00:00 GMT PraisonAI versions 1.4.0 through 1.7.1 contain a sandbox escape vulnerability in the codeMode tool, allowing authenticated attackers to execute arbitrary code on the host filesystem. Fix documented: 1.7.2 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-57122/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-57122 Tue, 15 Sep 2026 12:00:00 GMT PraisonAI is a multi-agent teams system. Fix documented: 4.6.59 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-57123/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-57123 Tue, 15 Sep 2026 12:00:00 GMT PraisonAI agents fail to enforce authentication or origin validation on critical endpoints, allowing unauthenticated attackers to execute arbitrary tools, shell commands, or code. Fix documented: 1.6.59 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-57124/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-57124 Tue, 15 Sep 2026 12:00:00 GMT PraisonAI versions prior to 4.6.59 are vulnerable to unauthenticated OS command injection via the /api/mcp/connect endpoint, allowing remote code execution as the UI service account. Fix documented: 4.6.59 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-57125/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-57125 Tue, 15 Sep 2026 12:00:00 GMT An unauthenticated remote code execution vulnerability in PraisonAI allows attackers to execute arbitrary operating system commands via the /api/v1/runs Jobs API. Fix documented: 4.6.59 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-57126/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-57126 Tue, 15 Sep 2026 12:00:00 GMT PraisonAI is a multi-agent teams system. Fix documented: 1.6.59 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-57127/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-57127 Tue, 15 Sep 2026 12:00:00 GMT PraisonAI fails to enforce API key or JWT authentication when environment variables are missing, allowing unauthenticated attackers to execute recipes and trigger connected tools. Fix documented: 4.6.59 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-57130/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-57130 Tue, 15 Sep 2026 12:00:00 GMT PraisonAI is a multi-agent teams system. Fix documented: 1.6.59 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-57131/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-57131 Tue, 15 Sep 2026 12:00:00 GMT PraisonAI versions prior to 4.6.58 suffer from missing authentication and authorization, allowing unauthenticated network clients to manipulate jobs and execute arbitrary agent configurations. Fix documented: 4.6.59 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-57132/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-57132 Tue, 15 Sep 2026 12:00:00 GMT PraisonAI is a multi-agent teams system. Fix documented: 4.6.61 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-55526/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-55526 Wed, 26 Aug 2026 12:00:00 GMT PraisonAI is a multi-agent teams system Fix documented: 1.6.58 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-55534/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-55534 Wed, 26 Aug 2026 12:00:00 GMT PraisonAI is a multi-agent teams system Fix documented: 4.6.58 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-55539/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-55539 Wed, 26 Aug 2026 12:00:00 GMT PraisonAI is a multi-agent teams system Fix documented: 4.6.58 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-55541/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-55541 Wed, 26 Aug 2026 12:00:00 GMT PraisonAI is a multi-agent teams system Fix documented: 4.6.58 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-48169/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-48169 Sat, 08 Aug 2026 12:00:00 GMT PraisonAI is a multi-agent teams system Fix documented: 0.1.4 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-48168/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-48168 Thu, 06 Aug 2026 12:00:00 GMT PraisonAI versions prior to 4.6.40 contain a command injection vulnerability in its GitHub Actions workflow, allowing unauthenticated attackers to execute arbitrary shell code. Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-61430/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-61430 Fri, 17 Jul 2026 12:00:00 GMT PraisonAI before 1 Fix documented: 1.6.78 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-61435/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-61435 Fri, 17 Jul 2026 12:00:00 GMT PraisonAI before 4 Fix documented: 4.6.78 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-61436/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-61436 Fri, 17 Jul 2026 12:00:00 GMT PraisonAI before 4 Fix documented: 4.6.78 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-61446/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-61446 Fri, 17 Jul 2026 12:00:00 GMT PraisonAI (praisonaiagents) before 1 Fix documented: 1.6.78 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-61442/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-61442 Mon, 13 Jul 2026 12:00:00 GMT PraisonAI Platform (praisonai-platform) before 0 Fix documented: 0.1.9 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-60090/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-60090 Sun, 12 Jul 2026 12:00:00 GMT PraisonAI fails to validate the dimension argument in its knowledge-store backends, enabling SQL/CQL injection via specially crafted strings. Fix documented: 4.6.78 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-60091/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-60091 Sun, 12 Jul 2026 12:00:00 GMT PraisonAI before 4 Fix documented: 4.6.78 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-61426/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-61426 Sun, 12 Jul 2026 12:00:00 GMT PraisonAI before 1 Fix documented: 1.7.3 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-61428/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-61428 Sun, 12 Jul 2026 12:00:00 GMT PraisonAI AgentMail versions before 4 Fix documented: 4.6.78 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-61429/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-61429 Sun, 12 Jul 2026 12:00:00 GMT PraisonAI versions before 1 Fix documented: 1.6.78 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-61439/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-61439 Sun, 12 Jul 2026 12:00:00 GMT PraisonAI versions before 4 Fix documented: 4.6.78 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-61445/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-61445 Sun, 12 Jul 2026 12:00:00 GMT PraisonAI is vulnerable to arbitrary file write and command execution via the AICoder component due to missing path and command validation in LLM tool calls. Fix documented: 4.6.78 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-61447/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-61447 Sun, 12 Jul 2026 12:00:00 GMT PraisonAI contains a remote code execution vulnerability in CodeAgent._execute_python() that allows attackers to execute arbitrary code via LLM prompt injection. Fix documented: 1.6.78 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-61434/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-61434 Sat, 11 Jul 2026 12:00:00 GMT PraisonAI versions before 4 Fix documented: 4.6.78 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-61437/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-61437 Sat, 11 Jul 2026 12:00:00 GMT PraisonAI (pip package praisonaiagents) before 1 Fix documented: 1.6.78 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-61444/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-61444 Sat, 11 Jul 2026 12:00:00 GMT PraisonAI contains a code injection vulnerability in its API module where unsanitized user input is passed to subprocess.Popen(), allowing arbitrary code execution. Fix documented: 4.6.78 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-44338/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-44338 Sun, 10 May 2026 12:00:00 GMT PraisonAI is a multi-agent teams system Fix documented: 4.6.34 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-41496/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-41496 Sat, 09 May 2026 12:00:00 GMT PraisonAI is a multi-agent teams system Fix documented: 4.5.149 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-41497/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-41497 Sat, 09 May 2026 12:00:00 GMT PraisonAI fails to validate commands in parse_mcp_command(), allowing unauthenticated attackers to execute arbitrary system commands via subprocesses. Fix documented: 4.5.149 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-44334/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-44334 Sat, 09 May 2026 12:00:00 GMT PraisonAI is a multi-agent teams system Fix documented: 4.6.32 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-44335/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-44335 Sat, 09 May 2026 12:00:00 GMT PraisonAI contains a logical flaw in its URL checking mechanism that allows unauthenticated attackers to perform Server-Side Request Forgery (SSRF) attacks. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-44336/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-44336 Sat, 09 May 2026 12:00:00 GMT PraisonAI's MCP server fails to sanitize file paths in tool arguments, allowing unauthenticated attackers to perform arbitrary file writes and achieve code execution. Fix documented: 4.6.34 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-44339/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-44339 Sat, 09 May 2026 12:00:00 GMT PraisonAI is a multi-agent teams system Fix documented: 1.6.37 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-44340/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-44340 Sat, 09 May 2026 12:00:00 GMT PraisonAI is a multi-agent teams system Fix documented: 4.6.37 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-40287/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-40287 Tue, 14 Apr 2026 12:00:00 GMT PraisonAI is a multi-agent teams system Fix documented: 1.5.140 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-40288/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-40288 Tue, 14 Apr 2026 12:00:00 GMT PraisonAI is a multi-agent teams system. Fix documented: 1.5.140 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-40289/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-40289 Tue, 14 Apr 2026 12:00:00 GMT PraisonAI is a multi-agent teams system. Fix documented: 1.5.140 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-40313/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-40313 Tue, 14 Apr 2026 12:00:00 GMT PraisonAI is a multi-agent teams system. Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-40116/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-40116 Sat, 11 Apr 2026 12:00:00 GMT PraisonAI is a multi-agent teams system Fix documented: 4.5.128 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-40156/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-40156 Sat, 11 Apr 2026 12:00:00 GMT PraisonAI is a multi-agent teams system Fix documented: 4.5.128 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-40158/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-40158 Sat, 11 Apr 2026 12:00:00 GMT PraisonAI is a multi-agent teams system Fix documented: 4.5.128 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-39889/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-39889 Fri, 10 Apr 2026 12:00:00 GMT PraisonAI is a multi-agent teams system Fix documented: 4.5.115 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-40088/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-40088 Fri, 10 Apr 2026 12:00:00 GMT PraisonAI is a multi-agent teams system. Fix documented: 4.5.121 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-40113/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mervinpraison-CVE-2026-40113 Fri, 10 Apr 2026 12:00:00 GMT PraisonAI is a multi-agent teams system Fix documented: 4.5.128 (OSV.dev). Independent analyst report on CVE Brief.