PyPI/praisonai CVE-2026-55532: high 7.6, EPSS 0.20%

PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server

Action: Upgrade praisonai to 4.6.58 or later.

pip install praisonai==4.6.58

Affected

Fixed versions

Sources

• osv: GHSA-pvph-5j39-v8qc
• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-pvph-5j39-v8qc
• https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1
• https://github.com/MervinPraison/PraisonAI
• https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58

CVE-2026-55532 · published 2026-08-25T15:18:20Z · modified 2026-09-10T12:25:45.093217580Z · JSON