PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code

SSRF bypass in PraisonAI

PraisonAI: Critical RCE via `type: job` workflow YAML

PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution

PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions

PraisonAIAgents has an OS Command Injection via shell=True in Memory Hooks Executor (memory/hooks.py)

PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute

PraisonAI: SSRF in FileTools.download_file() via Unvalidated URL

PraisonAI has RCE via Automatic tools.py Import

PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)

PraisonAIAgents Affected by Arbitrary File Read via read_skill_file Missing Workspace Boundary and Approval Gate

PraisonAIAgents has SSRF via unvalidated URL in `web_crawl` httpx fallback

PraisonAIAgents Affected by Environment Variable Secret Exfiltration via os.path.expandvars() Bypassing shell=False in Shell Tool

PraisonAIAgents has SSRF and Local File Read via Unvalidated URLs in web_crawl Tool

PraisonAIAgents has a Path Traversal via Unvalidated Glob Pattern in list_files Bypasses Workspace Boundary