npm PraisonAI AgentOS exposes unauthenticated agent listing and invocation
Date: 2026-06
Affected: npm/praisonai
Attack vector: prompt-injection
Category: vulnerability-disclosure
Severity: Critical
CWE: CWE-306
CVSS: 9.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L)

## Summary The published npm package `praisonai` ships a TypeScript `AgentOS` HTTP server that defaults to `host: "0.0.0.0"` and registers sensitive agent routes without any authentication or authorization middleware. When a developer starts `AgentOS`, a network attacker who can reach the service can: - read configured agent names, roles, and the first 100 characters of each agent's instructions through `GET /api/agents`; and - invoke the selected agent through `POST /api/chat` without credentials. This is distinct from the existing Python/PyPI AgentOS and API-server advisories. The affected package here is `npm:praisonai`; the current published npm package is `1.7.1`, and the same TypeScript source is still present in refreshed `origin/main` at `v4.6.58`. ## Technical Details `AgentOSConfig` exposes host, CORS, and API-prefix settings but no authentication token, auth mode, or authorization callback. Relevant current-head source: ```text src/praisonai-ts/src/os/config.ts 26: host?: string; // default: "0.0.0.0" 35: corsOrigins?: string[]; // default: ["*"] 66: export const DEFAULT_AGENTOS_CONFIG = { 68: host: '0.0.0.0', 71: corsOrigins: ['*'], ``` `AgentOS._createApp()` registers JSON parsing and CORS handling, then immediately registers routes. There is no middleware between body parsing and route registration that validates an API key, bearer token, session, origin-bound secret, or any other credential. Relevant current-head sou


Mitigations:

Architectural layers (MAESTRO):