Duplicate Advisory: PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-fj8f-m44g-c479. This link is maintained to preserve external references.

Original Description

PraisonAI versions before 4.6.78 contain a prompt injection defense misconfiguration where the block threshold defaults to CRITICAL severity, allowing HIGH-level threats to pass through unblocked. Attackers can submit single-vector prompt injection attacks such as instruction overrides or financial manipulation that trigger HIGH severity detection but are logged without blocking, enabling system prompt extraction and unauthorized tool invocations.