Which versions of PraisonAI are affected by CVE-2026-61433?

PraisonAI versions prior to 4.6.78 contain a code injection vulnerability in the deployment generator that could allow attackers to execute arbitrary Python code within API server processes; no…. A patch is available.

How to fix or mitigate CVE-2026-61433?

Within 24 hours, conduct a complete inventory of all systems running PraisonAI to identify instances prior to version 4.6.78 and assess their criticality and exposure. Within 7 days, apply the vendor patch by upgrading all affected systems to PraisonAI version 4.6.78 or later, prioritizing production API servers and those with external network exposure; simultaneously audit and restrict access controls for deployment configuration to limit who can modify deploy.api.host and agents_file parameters. By day 30, confirm all systems have been upgraded to version 4.6.78 or later, implement continuous monitoring for unauthorized deployment configuration changes, and document the completion of remediation efforts.

PraisonAI CVE-2026-61433

Q: What is the CVSS score of CVE-2026-61433?

CVE-2026-61433 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-44640 HIGH

Code Injection (CWE-94)

2026-07-15 VulnCheck

GHSA-qpq9-hwx9-cwgc

RCE Python Code Injection Praisonai Mervinpraison

8.5

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

AV:L because exploitation requires controlling local deployment config; PR:L since supplying the config/agents file needs some privilege; full C/I/A impact from arbitrary Python execution in the server process.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 15, 2026 - 12:26 vuln.today

Analysis Generated

Jul 15, 2026 - 12:26 vuln.today

CVE Published

Jul 15, 2026 - 11:25 cve.org

HIGH 8.5

DescriptionCVE.org

PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Python source code for API servers. Attackers can inject arbitrary Python expressions through the deploy.api.host and agents_file configuration parameters that execute when the generated server starts or handles requests.

Articles & Coverage 1

News 7 New Python Vulnerabilities - 7 High Severity, No Public POC Jul 16, 2026

AnalysisAI

Code injection in PraisonAI before 4.6.78 lets attackers who control deployment configuration achieve arbitrary Python execution because the API-server deployment generator fails to safely encode the deploy.api.host and agents_file values before emitting them into generated Python source (CWE-94). Injected expressions run when the generated API server starts or handles requests, yielding full code execution in the server process. No public exploit is identified at time of analysis; the flaw was reported by VulnCheck and a vendor patch is available.

Technical ContextAI

PraisonAI (CPE cpe:2.3:a:mervinpraison:praisonai) is an open-source Python multi-agent framework whose CLI can auto-generate an API server from deployment configuration. The generator constructs Python source code by interpolating configuration values - specifically deploy.api.host and the agents_file path - directly into the emitted source without escaping or safe quoting. This is a classic CWE-94 'Improper Control of Generation of Code' (code injection) root cause: attacker-influenced data crosses into a code-generation sink, so any Python expression placed in those fields becomes executable statements rather than inert string data once the generated module is imported and run.

RemediationAI

Upgrade to PraisonAI 4.6.78 or later, which is the first release incorporating the fix; the change is in commit 1620b49f36945d8cc8ee5635b906c960df5097a0 and described in advisory GHSA-79fv-7hq9-w7xg (https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-79fv-7hq9-w7xg). Until upgrading, treat the deployment configuration as untrusted: do not generate or run API servers from configuration supplied by other users, restrict write access to the deploy.api.host and agents_file settings and the underlying config/agents YAML to trusted operators only, and validate that host values match a strict hostname/IP allowlist before invoking the deployment generator. These controls limit who can reach the vulnerable code-generation path but do not remove the injection itself, so patching remains the durable fix.