CyberRota Analysis
AI-GeneratedThe vulnerability affects Chrome extensions used in the PraisonAI multi-agent system, where improper validation of extension origins allows for unauthorized browser automation and execution of start_session commands. This critical flaw, with a CVSS score of 9.1, poses significant security risks, enabling potential exploitation by attackers. Organizations utilizing PraisonAI versions prior to 4.6.58 should prioritize immediate updates to mitigate the risk of unauthorized access and automation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server _handle_connection() checks Chrome extension origins with re.match() and the unanchored expression chrome-extension://[a-z0-9]{32}. Extra trailing characters pass before websocket.accept(), allowing start_session commands and unauthorized browser automation. This issue is fixed in version 4.6.58.