CVE-2026-55536 in PraisonAI
Summary
by MITRE • 08/25/2026
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server _handle_connection() checks Chrome extension origins with re.match() and the unanchored expression chrome-extension://[a-z0-9]{32}. Extra trailing characters pass before websocket.accept(), allowing start_session commands and unauthorized browser automation. This issue is fixed in version 4.6.58.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified in PraisonAI versions prior to 4.6.58 stems from a critical input validation flaw within the Browser Server component, specifically affecting the _handle_connection() method responsible for managing WebSocket connections. This function is designed to enforce security policies by verifying that incoming connection requests originate from authorized Chrome extensions. The mechanism relies on regular expression matching to validate the origin header against an expected pattern representing valid extension identifiers. However, the implementation utilizes an unanchored regular expression, chrome-extension://[a-z0-9]{32}, which fails to enforce strict boundary conditions for string termination. In standard regex usage without anchors such as ^ and $, a match is considered successful if the pattern appears anywhere within the input string, rather than requiring the entire string to conform exactly to the specified format.
This technical deficiency allows attackers to bypass origin validation checks by appending extra trailing characters to what would otherwise be a valid Chrome extension identifier. For instance, an attacker could craft a request with an origin header that begins correctly as chrome-extension:// followed by thirty-two alphanumeric characters but includes additional suffixes or garbage data at the end. Because the unanchored expression matches the prefix portion of this malformed string, the validation logic incorrectly deems the connection as legitimate and authorized. Consequently, the server proceeds to accept the WebSocket connection via websocket.accept() without rejecting the request based on its non-compliant structure. This bypass effectively neutralizes the intended security control designed to restrict browser automation capabilities exclusively to trusted extensions.
The operational impact of this vulnerability is significant, particularly in environments where PraisonAI facilitates automated web interactions or sensitive data processing through browser agents. By exploiting this flaw, an unauthorized actor can establish a WebSocket connection that appears legitimate to the server infrastructure. Once connected, the attacker gains the ability to send start_session commands and execute arbitrary browser automation tasks. This unauthorized access enables malicious activities such as scraping protected content, manipulating user interfaces, performing actions on behalf of authenticated users if session tokens are accessible, or potentially pivoting into other parts of the system depending on the privileges granted to the automated agent. The lack of strict origin validation undermines the principle of least privilege and exposes the automation framework to abuse by external entities that do not possess legitimate extension credentials.
To mitigate this vulnerability, organizations must immediately upgrade PraisonAI to version 4.6.58 or later, where the regular expression has been corrected to enforce exact matching boundaries. This fix ensures that only origins strictly conforming to the chrome-extension://[a-z0-9]{32} format are accepted, rejecting any requests with extraneous characters. In addition to upgrading, security teams should implement defense-in-depth strategies by validating origin headers at multiple layers of the application stack rather than relying solely on a single validation point within the WebSocket handler. It is also advisable to monitor logs for unusual connection patterns or unexpected browser automation activities that may indicate attempted exploitation before patches are applied. This incident highlights the importance of rigorous input validation practices, particularly when dealing with security-sensitive protocols like WebSockets and origin-based access controls.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, as the system failed to correctly sanitize or validate user-supplied data before using it in a security decision. The specific failure mode of allowing trailing characters due to unanchored regex patterns is a classic example of insufficient boundary enforcement. Furthermore, the exploitation technique relates to ATT&CK tactic TA0001 Initial Access and potentially TA0005 Defense Evasion if used to bypass authentication mechanisms indirectly by masquerading as an authorized extension. The ability to initiate sessions without proper authorization also touches upon CWE-287 Improper Authentication, although the primary failure lies in the validation of the origin identifier rather than credential verification itself. Addressing these issues requires both immediate patching and long-term improvements in how security controls are implemented within automated agent frameworks to prevent similar bypasses in future versions.