Skip to content
Threat Feed
Subscribe

Product

Praisonai (Npm Package) (>= 1.6.0, <= 1.7.1)

1 brief RSS
critical advisory

npm PraisonAI AgentOS Unauthenticated API Exposure

The npm `praisonai` package's TypeScript `AgentOS` HTTP server defaults to `0.0.0.0` and exposes unauthenticated API endpoints (`/api/agents`, `/api/chat`), allowing attackers to disclose agent configurations and invoke agents without authorization, leading to potential data exfiltration, unauthorized actions, and resource consumption.

praisonai api-abuse unauthenticated-access information-disclosure server-side-request-forgery web node.js npm
2r 4t