Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• highCVE-2026-55581

  CVE-2026-55581: mcp-shell Secure Mode Allowlist Bypass via /bin/bash -c

  The default Docker configuration for mcp-shell lists /bin/bash as an allowed executable, and the validator only checks the first token of a command, so any caller can append '-c <cmd>' to run…

• highCVE-2026-55580

  CVE-2026-55580: mcp-shell OS Command Injection via Security-Disabled Default and Shell Interpreter in Allowlist

  mcp-shell shipped with security completely disabled by default and included shell interpreters like /bin/bash in its example allowlist, meaning any connected LLM could run arbitrary commands on the…

• highCVE-2026-55539

  CVE-2026-55539: PraisonAI Jobs API Missing Authentication

  PraisonAI's async jobs API has no authentication on any of its endpoints, letting anyone who can reach the server submit agent jobs, read other users' results, cancel running jobs, and delete…

• highCVE-2026-55532

  CVE-2026-55532: PraisonAI MCP HTTP Server Origin Validation Bypass (CSRF)

  A flaw in PraisonAI's local MCP server lets any website forge unauthenticated requests to a developer's machine by crafting an Origin header that starts with 'http://localhost', bypassing the…

• criticalCVE-2026-55536

  CVE-2026-55536: PraisonAI WebSocket Origin Validation Bypass via Unanchored Regex

  PraisonAI's browser server accepts WebSocket connections from any client that forges an Origin header slightly longer than a real Chrome extension ID, because the regex check uses re.match() instead…

• criticalCVE-2026-55546

  CVE-2026-55546: qwed-mcp Remote Code Execution via Unsafe SymPy parse_expr()

  The math verification function in qwed-mcp passes user-supplied strings straight into SymPy's expression parser, which internally calls Python's eval() with no sandbox, letting any caller run…

• highCVE-2026-55538

  CVE-2026-55538: PraisonAI serve agents --api-key Authentication Bypass

  PraisonAI's 'serve agents' command accepts an --api-key flag but never enforces it, so anyone who can reach the server can invoke registered agents without any credentials.

• highCVE-2026-55537

  CVE-2026-55537: PraisonAI Webhook SSRF via DNS Fail-Open and TOCTOU Race

  PraisonAI's job webhook validator silently accepts URLs when DNS resolution fails, and re-resolves hostnames at execution time, letting an attacker redirect the server's HTTP POST to any internal…

• highCVE-2026-55541

  CVE-2026-55541: PraisonAI serve --api-key Flag Missing Authorization

  PraisonAI's serve command accepts an --api-key flag that it never actually enforces, leaving every agent workflow endpoint wide open to anyone who can reach the server.

• highCVE-2026-55528

  CVE-2026-55528: praisonaiagents AgentServer Missing Authentication

  praisonaiagents lets operators set an auth_token on its built-in HTTP server, but the server never actually checks it, so any unauthenticated caller can read server config, inject events into every…

• highCVE-2026-55526

  CVE-2026-55526: praisonaiagents SSRF Protection Bypass via Wildcard DNS Hostname

  The spider_tools SSRF filter in praisonaiagents never resolves hostnames to IP addresses, so an attacker can use a public wildcard DNS service like nip.io to reach internal services that the filter…

• highCVE-2026-55524

  CVE-2026-55524: praisonaiagents SSRF via Redirect and DNS Rebinding in web_crawl

  The web_crawl tool in praisonaiagents validates a URL's hostname once before fetching, but follows HTTP redirects and re-resolves DNS at connect time without re-checking, letting attackers reach…