The Browser Server in PraisonAI validates WebSocket origin headers using an unanchored regular expression. An attacker can supply an origin that matches chrome-extension://[a-z0-9]{32} but includes extra trailing characters. The server accepts such a connection, bypasses the intended origin check, and allows an unauthorized start_session command to be processed. This provides the attacker the ability to initiate browser automation commands without authentication, effectively giving remote execution privileges within the browser context.

The vulnerability affects the MervinPraison PraisonAI multi‑agent teams system prior to version 4.6.58. Any deployment running a version older than 4.6.58 is susceptible to the origin bypass. The issue is corrected in release 4.6.58, available from the PraisonAI GitHub repository.

The CVSS base score of 9.1 classifies this flaw as critical. Although EPSS data are not available, the flaw is not logged in the CISA KEV catalog. Because the flaw allows unauthorized WebSocket connections and command injection, an attacker with network reach to the Browser Server endpoint can craft a malicious origin header and issue start_session commands, achieving unauthorized automation or arbitrary code execution. The exploit can be deployed remotely without the need for local user privileges, making it a high‑risk vulnerability.