PraionAI’s legacy Server Event Stream (SSE) transport, used by ToolsMCPServer.run_sse() in praisonaiagents from 0.6.0 to 1.6.59 and PraionAI from 3.10.0 to 4.6.59, mounts a SseServerTransport on the legacy /sse and /messages/ endpoints without default Host, Origin, or authentication checks. A malicious website can perform DNS rebinding to reach a locally or internally reachable SSE server, supply attacker‑controlled Host and Origin headers, and enumerate and invoke registered tools with the server user’s privileges. Because the Streamable HTTP transport rejects the same hostile Origin, the flaw is isolated to the legacy SSE wrapper, providing a path for an attacker to execute arbitrary tool code with local privileges—a remote code execution or privilege escalation vulnerability. This weakness corresponds to CWE‑306, CWE‑346, and CWE‑862.

The vulnerability affects MervinPraison:PraisonAI versions 3.10.0 through 4.6.59 and MervinPraison:praisonaiagents versions 0.6.0 through 1.6.59. Affected were the legacy SSE wrapper of the ToolsMCPServer, specifically the /sse and /messages/ endpoints.

The CVSS score of 8.3 indicates high impact, while the EPSS score of less than 1% suggests a low current exploitation probability. The flaw is not listed in CISA’s KEV catalog. An attacker requires the ability to reach the SSE service, perform a DNS rebinding attack, and set custom Host and Origin headers. The fix was introduced in praisonaiagents 1.6.59 and PraionAI 4.6.59, isolating the flaw to the legacy SSE transport.