THREAT OPS › Threat News › [GHSA] GHSA-6g6r-q6gw-w8fg (critical) — PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)
[GHSA] GHSA-6g6r-q6gw-w8fg (critical) — PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)
GHSA-6g6r-q6gw-w8fg Severity: critical CVE: CVE-2026-55536
PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)
### Summary
`praisonai/browser/server.py` validates incoming WebSocket connections using a Chrome extension Origin check. The regex `chrome-extension://[a-z0-9]{32}` is applied with `re.match()`,
MITRE ATT&CK techniques
- CredentialsT1589.001
Indicators of compromise
- CVE-2026-40289cve
- CVE-2026-55536cve
- http://attacker.com/steal?data=url
- https://evil.comurl
Original source: https://github.com/advisories/GHSA-6g6r-q6gw-w8fg