CyberRota Analysis
AI-GeneratedPraisonAI versions prior to 4.6.58 are vulnerable due to a flaw in the MCP HTTP Stream _validate_origin function, which improperly allows requests from attacker-controlled origins to bypass security checks. This can lead to unauthorized file writes and the execution of agent instructions without proper authentication, posing a significant risk of data manipulation and system compromise. Organizations using affected versions should prioritize upgrading to 4.6.58 to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream _validate_origin uses request_origin.startswith(allowed), allowing the attacker-controlled localhost.attacker.com HTTP origin to satisfy the localhost allowlist. A webpage can send Content-Type: text/plain requests without preflight and invoke tools/call without an API key, including file writes that persist agent instructions. This issue is fixed in version 4.6.58.