{"action":"Upgrade praisonai to 1.7.2 or later.","affected":[{"fixed":"1.7.2","introduced":"1.5.0"}],"component":"praisonai","cve_ids":["CVE-2026-57139"],"ecosystem":"npm","epss":0.00754,"exploited":false,"fixed_versions":["1.7.2"],"ghsa_id":"GHSA-j4f3-55x4-r6q2","id":"tcs_01M5KFWX7K7P86GCGN516HHVPY","modified_at":"2026-07-20T21:56:44.493373Z","published_at":"2026-06-18T14:26:48Z","references":["https://osv.dev/vulnerability/GHSA-j4f3-55x4-r6q2","https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-j4f3-55x4-r6q2","https://github.com/MervinPraison/PraisonAI"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-j4f3-55x4-r6q2","url":"https://osv.dev/vulnerability/GHSA-j4f3-55x4-r6q2"}],"summary":"npm PraisonAI MCPServer exposes unauthenticated HTTP tools/call"}