Executive Summary

The vulnerability exists in PraisonAI versions prior to 4.5.90, specifically in the MCPToolIndex.search_tools() function. This function takes a string input from the caller and compiles it directly as a Python regular expression without any validation, sanitization, or timeout controls.

An attacker can craft a malicious regular expression that causes catastrophic backtracking in the Python regex engine. This leads to the Python thread being blocked for hundreds of seconds, resulting in a complete service outage.

The issue was fixed in version 4.5.90 of PraisonAI.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a denial of service (DoS) condition by blocking the Python thread for an extended period due to catastrophic backtracking in the regex engine.

As a result, the affected PraisonAI service can become completely unavailable, leading to service outages and disruption of normal operations.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade PraisonAI to version 4.5.90 or later, where the issue has been patched.

Useful 0 Not Useful 0