CVE-2026-61447

CRITICAL SEVERITY

CVSS Score & Metrics

Base Score

10.0 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H                                    

Vulnerability Description

PraisonAI before 1.6.78 contains a remote code execution vulnerability in CodeAgent._execute_python() that executes LLM-generated Python code without AST validation, import restrictions, or sandbox enforcement. Attackers can influence LLM output through prompt injection to exfiltrate all environment secrets and execute arbitrary code on the host system.

Vulnerability Details

Published Date

July 11, 2026

Last Modified

July 11, 2026

CWE ID

CWE-94

Source

NVD

Vendor

MervinPraison

Product

PraisonAI

External References

https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-2xv2-w8cq-5gxw
https://www.vulncheck.com/advisories/praisonai-before-remote-code-execution-via-codeagent

CVE-2026-61447

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment