External risk intelligence

PraisonAI Browser Server Unauthorized Automation Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-55536

The vulnerability exists in a browser-based agent automation server. Such tools are commonly deployed as web interfaces or API services intended for remote or automated interaction, often exposing websocket interfaces to the network to facilitate browser control, making them frequently accessible in network-connected environments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability was discovered in PraisonAI, a system for multi-agent teams, that could allow unauthorized control of browsers. This issue arises from how the system checks for Chrome extension origins, potentially enabling malicious commands to be executed. The concern is that this could lead to unauthorized browser automation, impacting systems that utilize this technology for their operations.

Unauthorized browser control is possible.
Confirms the need to verify system relevance.
Assess potential impact and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network requests to the PraisonAI system. This would involve interacting with the browser server's connection handling, specifically targeting the `_handle_connection()` function. By providing input that bypasses the regular expression check for Chrome extensions, an attacker could trick the system into accepting a connection and allowing unauthorized commands, potentially leading to control over automated browser actions.

No authentication required.
Triggered by malformed connection requests.
Risk: Unauthorized browser automation.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, the PraisonAI system's browser server could allow unauthorized browser automation by accepting crafted commands. This could potentially lead to the execution of unintended actions within the browser session.

System access to browser automation controls.
Malformed requests can be accepted.
Unintended browser actions may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for managing the PraisonAI system, likely platform or application owners, should initiate an inventory of all instances of the affected technology. The immediate next step is to determine the reachability and business criticality of each instance to prioritize remediation efforts, which may involve vendor coordination for updates.

Platform or application owners should lead.
Verify instance reachability and criticality.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is PraisonAI?

PraisonAI is a framework designed to coordinate multi-agent teams, allowing them to collaborate and execute complex tasks. It includes features for browser automation, which enable these agents to interact with web environments programmatically to perform actions on behalf of the user or system.

What does CWE-625 mean for CVE-2026-55536?

This CVE involves an improper input validation weakness, specifically classified as CWE-625 (Permissive Regular Expression). The system uses an unanchored pattern to verify Chrome extension origins, meaning it only checks if the string starts correctly but ignores extra, malicious characters appended to the end. This allows unauthorized connections to bypass security checks.

How can an attacker trigger this vulnerability?

An attacker triggers the flaw by sending a specifically crafted network request to the browser server. Because the validation logic for Chrome extensions is flawed, providing an input that satisfies the beginning of the regular expression while including trailing data tricks the system into accepting the connection. Standard, valid browser extension requests do not trigger this issue.

Is my PraisonAI instance at risk?

Halo Surface Signal indicates that PraisonAI browser servers are often deployed as web interfaces or API services reachable over a network to facilitate remote automation. If your instance is exposed to the internet or accessible via an internal network where untrusted parties can send requests to the server, it may be susceptible to unauthorized browser control.

How do I secure my environment against this threat?

If you are running a version of PraisonAI prior to 4.6.58, you should update to the patched version immediately. Begin by conducting an inventory of all instances of the software in your environment. Once identified, prioritize these instances based on their network reachability and the criticality of the automated tasks they perform to ensure timely remediation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.