CVE-2026-40289

{
  "id": "CVE-2026-40289",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-14T04:17:12.710",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PraisonAI is a multi-agent teams system. In versions below 4.5.139 of PraisonAI and 1.5.140 of praisonaiagents, the browser bridge (praisonai browser start) is vulnerable to unauthenticated remote session hijacking due to missing authentication and a bypassable origin check on its /ws WebSocket endpoint. The server binds to 0.0.0.0 by default and only validates the Origin header when one is present, meaning any non-browser client that omits the header is accepted without restriction. An unauthenticated network attacker can connect, send a start_session message, and the server will route it to the first idle browser-extension WebSocket (effectively hijacking that session) and then broadcast all resulting automation actions and outputs back to the attacker. This enables unauthorized remote control of connected browser automation sessions, leakage of sensitive page context and automation results, and misuse of model-backed browser actions in any environment where the bridge is network-reachable. This issue has been fixed in versions 4.5.139 of PraisonAI and 1.5.140 of praisonaiagents."
    },
    {
      "lang": "es",
      "value": "PraisonAI es un sistema de equipos multiagente. En versiones anteriores a la 4.5.139 de PraisonAI y la 1.5.140 de praisonaiagents, el puente del navegador (praisonai browser start) es vulnerable al secuestro remoto de sesión no autenticado debido a la falta de autenticación y a una verificación de origen eludible en su endpoint WebSocket /ws. El servidor se enlaza a 0.0.0.0 por defecto y solo valida el encabezado Origin cuando está presente, lo que significa que cualquier cliente que no sea un navegador que omita el encabezado es aceptado sin restricciones. Un atacante de red no autenticado puede conectarse, enviar un mensaje start_session, y el servidor lo enrutará al primer WebSocket de extensión de navegador inactivo (secuestrando efectivamente esa sesión) y luego transmitirá todas las acciones y salidas de automatización resultantes de vuelta al atacante. Esto permite el control remoto no autorizado de sesiones de automatización del navegador conectadas, la fuga de contexto de página sensible y resultados de automatización, y el uso indebido de acciones del navegador respaldadas por modelos en cualquier entorno donde el puente sea accesible por red. Este problema ha sido solucionado en las versiones 4.5.139 de PraisonAI y 1.5.140 de praisonaiagents."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "MervinPraison",
          "product": "PraisonAI",
          "versions": [
            {
              "version": "< 4.5.139",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "MervinPraison",
          "product": "praisonaiagents",
          "versions": [
            {
              "version": "< 1.5.140",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-14T20:18:27.623888Z",
          "id": "CVE-2026-40289",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "4.5.139",
              "matchCriteriaId": "E5F6A0D4-AFE6-4DDA-A1C0-E74C7DD46E00"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:praison:praisonaiagents:*:*:*:*:*:python:*:*",
              "versionEndExcluding": "1.5.140",
              "matchCriteriaId": "37CF4D9C-AD55-414A-9BF2-49A51F03A682"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8x8f-54wf-vv92",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}