GHSA-9752-mhqh-h34f

## Summary The published npm package `praisonai` ships a TypeScript `AgentOS` HTTP server that defaults to `host: "0.0.0.0"` and registers sensitive agent routes without any authentication or authorization middleware. When a developer starts `AgentOS`, a network attacker who can reach the service can: - read configured agent names, roles, and the first 100 characters of each agent's instructions through `GET /api/agents`; and - invoke the selected agent through `POST /api/chat` without credentials. This is distinct from the existing Python/PyPI AgentOS and API-server advisories. The affected package here is `npm:praisonai`; the current published npm package is `1.7.1`, and the same TypeScript source is still present in refreshed `origin/main` at `v4.6.58`. ## Technical Details `AgentOSConfig` exposes host, CORS, and API-prefix settings but no authentication token, auth mode, or authorization callback. Relevant current-head source: ```text src/praisonai-ts/src/os/config.ts 26: host?: string; // default: "0.0.0.0" 35: corsOrigins?: string[]; // default: ["*"] 66: export const DEFAULT_AGENTOS_CONFIG = { 68: host: '0.0.0.0', 71: corsOrigins: ['*'], ``` `AgentOS._createApp()` registers JSON parsing and CORS handling, then immediately registers routes. There is no middleware between body parsing and route registration that validates an API key, bearer token, session, origin-bound secret, or any other credential. Relevant current-head source: ```text src/praisonai-ts/src/os/agentos.ts 179: app.use(express.json()); 182: // Add CORS middleware 204: // Register routes 205: this._registerRoutes(app); ``` The sensitive routes are then exposed: ```text src/praisonai-ts/src/os/agentos.ts 235: app.get(`${apiPrefix}/agents`, ...) 240: instructions: agent.instructions ? ... : null 250: app.post(`${apiPrefix}/chat`, ...) 273: const response = await agent.chat(message); 331: const host = options.host || this.config.host