Which versions of PraisonAI are affected by CVE-2026-61434?

PraisonAI (versions before 4.6.78) contains a command execution allowlist bypass that allows low-privileged attackers to circumvent the framework's security controls, enabling unauthorized file…. A patch is available.

How to fix or mitigate CVE-2026-61434?

Within 24 hours: Identify all systems running PraisonAI before 4.6.78; restrict network access to these instances to trusted sources only; review access logs for suspicious command submissions. Within 7 days: Isolate or disable PraisonAI instances that process sensitive data; implement enhanced input validation for all command parameters; document and evaluate alternative orchestration frameworks. Within 30 days: Monitor vendor advisories for PraisonAI 4.6.78 or later patch release; develop and test the compensating control framework below; establish mandatory upgrade timeline once patch is released.

PraisonAI CVE-2026-61434

Q: What is the CVSS score of CVE-2026-61434?

CVE-2026-61434 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-42899 HIGH

OS Command Injection (CWE-78)

2026-07-10 VulnCheck

GHSA-wrw8-384c-cg76

Command Injection Praisonai Mervinpraison

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable execution surface (AV:N/AC:L) but requires low-privileged access to submit commands (PR:L); allowlist escape yields full file read, deletion, and binary execution (C/I/A:H) within the same system, so S:U.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 10, 2026 - 16:16 EUVD

Analysis Generated

Jul 10, 2026 - 15:27 vuln.today

DescriptionCVE.org

PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell command execution that allows attackers to execute restricted commands via find's built-in -exec, -execdir, and -delete actions. Attackers can craft find commands with these built-in actions to read blocked files, delete files, or execute non-allowlisted binaries without triggering shell metacharacter filters.

AnalysisAI

Command execution allowlist bypass in PraisonAI before 4.6.78 lets a low-privileged attacker who can supply commands to the framework's restricted-execution feature slip past its shell-metacharacter filters by abusing find's built-in -exec, -execdir, and -delete actions. Because those actions run binaries and delete files entirely inside the find process, they never trip the metacharacter allowlist, so the attacker can read blocked files, delete arbitrary files, and launch non-allowlisted binaries. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 4.0 base score of 8.7 (High) reflects full loss of confidentiality, integrity, and availability of the affected system.

Technical ContextAI

PraisonAI is a Python-based multi-agent AI orchestration framework (CPE cpe:2.3:a:mervinpraison:praisonai) that can execute shell commands on behalf of agents or tools. To constrain this it uses an allowlist that filters on shell metacharacters and permitted binaries. The root cause is classic CWE-78 (OS Command Injection / improper neutralization of special elements in an OS command): the filter reasons about shell syntax, but GNU find is itself a mini command interpreter. Its -exec and -execdir primaries spawn arbitrary child processes and -delete removes files, all without any shell metacharacters (';', '|', '&', backticks) appearing in the command string. A defender who allows 'find' as a benign search tool therefore inadvertently grants a general-purpose exec/delete primitive, defeating the allowlist without ever invoking a shell.

RemediationAI

Vendor-released patch: 4.6.78 - upgrade PraisonAI to 4.6.78 or later, the primary and recommended fix (see GHSA-cv3g-hj65-pcfh). If you cannot upgrade immediately, remove 'find' from the command allowlist entirely, since its -exec/-execdir/-delete primaries make it impossible to safely allow as a search-only tool; the trade-off is losing legitimate filesystem-search functionality for agents. As defense in depth, stop treating shell-metacharacter filtering as the security boundary and run the command-execution component under a hardened OS sandbox (a locked-down container, a seccomp/AppArmor profile, or an unprivileged user with a read-only, minimal filesystem) so that even an allowlist bypass cannot read sensitive files or delete data - the cost is added deployment complexity and reduced tool flexibility. Also restrict who can reach the shell/tool-execution surface via network ACLs and authentication to shrink the PR:L attack surface. Advisory URLs: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-cv3g-hj65-pcfh and https://www.vulncheck.com/advisories/praisonai-before-allowlist-bypass-via-find-exec.