Description

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server _handle_connection() checks Chrome extension origins with re.match() and the unanchored expression chrome-extension://[a-z0-9]{32}. Extra trailing characters pass before websocket.accept(), allowing start_session commands and unauthorized browser automation. This issue is fixed in version 4.6.58.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-25T16:16:54.867Z",
  "pubdate": "2026-08-25T16:16:54.867Z",
  "executiveSummary": "A critical origin validation vulnerability exists in PraisonAI versions prior to 4.6.58, stemming from improper implementation of regular expression matching within the Browser Server _handle_connection() function.\nThe vulnerability allows an attacker to bypass origin-based access controls by appending malicious content to the end of a legitimate-looking Chrome extension identifier.\nBy failing to anchor the regular expression, the application incorrectly validates cross-origin requests, effectively permitting unauthorized entities to initiate browser automation sessions.\nThis flaw enables remote attackers to perform unauthorized actions through the browser automation interface, potentially leading to unauthorized data access, system manipulation, or command execution within the context of the user's browser session.\nSuccessful exploitation requires the attacker to be capable of triggering WebSocket connections directed at the Browser Server, as no further authentication is enforced once the origin check is bypassed.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper usage of the re.match() function within the Browser Server _handle_connection() method when verifying the origin of incoming WebSocket requests.\nThe security mechanism utilizes an unanchored regular expression defined as 'chrome-extension://[a-z0-9]{32}'.\nIn Python's re module, re.match() checks for a match only at the beginning of the string and does not require the pattern to consume the entire input string.\nBecause the expression lacks end-of-string anchors (such as '$'), any input that begins with the expected 'chrome-extension://' followed by the 32-character identifier will be validated as successful, even if additional characters are appended to the string.\nThe attack flow proceeds as follows: 1) The attacker crafts a malicious request header with an 'Origin' value constructed to pass the flawed regex (e.g., 'chrome-extension://[32_char_id]...'). 2) The _handle_connection() function executes the unanchored re.match(), which validates the prefix and returns a match object.\n3) The server proceeds to accept the WebSocket connection before applying further constraints.\n4) With the connection established, the attacker sends a 'start_session' command, which the server processes under the false assumption that the request originated from a trusted Chrome extension.\nThis allows the attacker to hijack the automation context, bypassing intended security boundaries established by the origin check.\nThe vulnerability affects all PraisonAI versions prior to 4.6.58.\nSince the vulnerability resides in the initial connection handshake phase, it does not require authentication or elevated privileges, provided the attacker can reach the Browser Server via network or local inter-process communication."
}