Which versions of PraisonAI are affected by CVE-2026-61437?

PraisonAI workflow automation framework (praisonaiagents) contains a vulnerability enabling arbitrary code execution through supplied workflow files, exposing organizations that deploy this tool to…. A patch is available.

How to fix or mitigate CVE-2026-61437?

Within 24 hours: Identify all systems running praisonaiagents versions prior to 1.6.78 and immediately restrict workflow file sources to internal code-reviewed processes only; disable automatic loading of workflows from untrusted or external sources. Within 7 days: Configure workflow execution under dedicated, least-privilege service accounts with minimal required permissions; implement network isolation for workflow systems and file integrity monitoring for unauthorized modifications to workflow directories. Within 30 days: Establish mandatory code review process for all workflow files including tools.py inspection, document and execute upgrade path to praisonaiagents 1.6.78+, and conduct risk assessment of whether workflow automation remains necessary for affected business processes.

PraisonAI CVE-2026-61437

Q: What is the CVSS score of CVE-2026-61437?

CVE-2026-61437 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-42900 HIGH

Protection Mechanism Failure (CWE-693)

2026-07-10 VulnCheck

GHSA-c6pq-cprj-62fw

Python RCE Praisonai

8.5

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local malicious-file RCE: attacker supplies workflow files (AV:L) and a victim must execute them (UI:R), no prior auth needed (PR:N), yielding full C/I/A compromise of the runner.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 10, 2026 - 16:16 EUVD

Analysis Generated

Jul 10, 2026 - 15:29 vuln.today

DescriptionCVE.org

PraisonAI (pip package praisonaiagents) before 1.6.78 contains an unsafe dynamic module loading vulnerability in AgentFlow._resolve_pydantic_class (src/praisonai-agents/praisonaiagents/workflows/workflows.py). When a workflow step uses a string output_pydantic reference, the framework locates and imports a sibling tools.py from the workflow file's directory via importlib exec_module without sandboxing, ignoring the PRAISONAI_ALLOW_*_TOOLS environment variables. An attacker who controls a workflow file and its sibling tools.py can execute arbitrary Python code with the workflow runner's privileges when the workflow is executed via WorkflowManager or after load_yaml.

Articles & Coverage 1

News 6 New Python Vulnerabilities - 1 Critical, 5 High, 1 With POC Jul 11, 2026

AnalysisAI

Arbitrary Python code execution in PraisonAI (praisonaiagents) before 1.6.78 occurs when AgentFlow._resolve_pydantic_class resolves a string output_pydantic reference in a workflow step, causing the framework to import a sibling tools.py from the workflow file's directory via importlib exec_module without any sandboxing. Because this loader ignores the PRAISONAI_ALLOW_*_TOOLS environment guardrails, an attacker who supplies a malicious workflow file plus its tools.py runs code with the workflow runner's privileges the moment the workflow is executed via WorkflowManager or loaded through load_yaml. No public exploit is identified at time of analysis, and the flaw is not listed in CISA KEV.

Technical ContextAI

PraisonAI is a Python multi-agent orchestration framework distributed as the praisonaiagents pip package, where workflows are typically defined in YAML/Python files and can reference Pydantic output schemas by string name. The vulnerable path is in src/praisonai-agents/praisonaiagents/workflows/workflows.py: when a workflow step's output_pydantic is a string, _resolve_pydantic_class searches the workflow file's directory for a sibling tools.py and loads it with importlib's exec_module, which executes all top-level code in that module. The root cause maps to CWE-693 (Protection Mechanism Failure): the framework already ships PRAISONAI_ALLOW_*_TOOLS environment controls intended to gate tool loading, but this resolution path bypasses them entirely, so the intended security boundary is not enforced. The affected CPE is cpe:2.3:a:mervinpraison:praisonai:*:*:*:*:*:*:*:* for all versions prior to 1.6.78.

RemediationAI

Vendor-released patch: upgrade praisonaiagents to 1.6.78 or later (pip install --upgrade 'praisonaiagents>=1.6.78') as the primary fix, per advisory GHSA-4gfv-wg42-7jw5. Until upgraded, treat workflow files and their directories as untrusted code: only load workflows from directories you fully control, and never run WorkflowManager or load_yaml against workflow files obtained from third parties or user uploads, since a co-located tools.py will be executed. As a compensating control, avoid using string-form output_pydantic references (pass an imported class object instead) so the sibling-tools.py resolution path is not triggered, and restrict filesystem write access to any directory from which workflows are loaded so an attacker cannot drop a malicious tools.py; note that these controls constrain legitimate dynamic-tool workflows and do not fully substitute for the patch. Do not rely on PRAISONAI_ALLOW_*_TOOLS environment variables here - this code path ignores them.