CVE-2026-57139criticalBroken access control2026-09-15

CVE-2026-57139: PraisonAI's npm MCP server and AgentOS let anyone call tools and agents

In the praisonai npm package up to 1.7.1, the TypeScript MCPServer's HTTP transport has no authentication and listens on all interfaces, so anyone who reaches the port can list and call tools, read resources and get prompts. AgentOS has the same problem for agents (CVE-2026-57140), and version 1.7.2 also fixes another codeMode sandbox escape (CVE-2026-57138).

01.

What it is

MCPServer.startHttp() in src/praisonai-ts/src/mcp/server.ts binds without a host restriction and forwards every POST to handleRequest() with no authentication or authorization. Any network client can call tools/list, tools/call, resources/read and prompts/get, running the registered handlers with the server's credentials. Affects 1.5.0 to 1.7.1.

CVE-2026-57140 (GHSA-9752-mhqh-h34f): AgentOS defaults to host 0.0.0.0 and registers GET /api/agents and POST /api/chat without authentication, so a remote caller can read agent names, roles and the start of their instructions and invoke an agent with its tools and credentials. Affects 1.6.0 to 1.7.1.

CVE-2026-57138 (GHSA-vmmj-pfw7-fjwp): codeMode runs untrusted JavaScript with new Function() inside with(sandbox); ({}).constructor.constructor recovers the real Function constructor and reaches process and require, so code can read secrets and run commands. Affects 1.4.0 to 1.7.1.

02.

How to check

Affected: praisonai (npm) up to 1.7.1. The fixed release is 1.7.2.
Check whether your code calls MCPServer start() with a port, starts AgentOS, or enables the codeMode tool.

03.

How to fix

Upgrade praisonai on npm to 1.7.2 or later. NVD calls 1.7.2 an initial remediation for the MCPServer and AgentOS issues, so keep these servers bound to localhost or behind an authenticating proxy as well.
If one of these servers was reachable from a network, rotate the API keys and credentials its tools and agents could use.

npm ls praisonai

04.

Sources

More advisories for this tool