Most recent entries from all

EUVD-2026-336464

fkie_cve-2026-61439

PraisonAI versions before 4.6.78 contain a prompt injection defense misconfiguration where the block threshold defaults to CRITICAL severity, allowing HIGH-level threats to pass through unblocked. Attackers can submit single-vector prompt injection attacks such as instruction overrides or financial manipulation that trigger HIGH severity detection but are logged without blocking, enabling system prompt extraction and unauthorized tool invocations.

Withdrawn: GHSA-5r2q-3wg3-57m2 — Duplicate Advisory: PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats

Withdrawn by the publisher.

Affected: PyPI: praisonai

### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fj8f-m44g-c479. This link is maintained to preserve external references.

### Original Description PraisonAI versions before 4.6.78 contain a prompt injection defense misconfiguration where the block threshold defaults to CRITICAL severity, allowing HIGH-level threats to pass through unblocked. Attackers can submit single-vector prompt injection attacks such as instruction overrides or financial manipulation that trigger HIGH severity detection but are logged without blocking, enabling system prompt extraction and unauthorized tool invocations.