Which versions of PraisonAI are affected by CVE-2026-61444?

PraisonAI versions prior to 4.6.78 contain a critical remote code execution vulnerability in the deployment API that allows authenticated users with high-level privileges to execute arbitrary Python…. A patch is available.

How to fix or mitigate CVE-2026-61444?

Within 24 hours: Restrict network access to PraisonAI deployment API endpoints to internal-only; audit current API users and permissions; enable detailed request logging on /deploy/api.py. Within 7 days: Verify patched version 4.6.78 or later availability from PraisonAI; if available, test in staging before production upgrade. Within 30 days: Deploy patched version or implement mandatory input sanitization on agents_file parameters and deploy API request filtering rules as interim controls.

PraisonAI CVE-2026-61444

Q: What is the CVSS score of CVE-2026-61444?

CVE-2026-61444 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-42902 CRITICAL

Code Injection (CWE-94)

2026-07-10 VulnCheck

GHSA-vwv5-32vr-3jcp

RCE Python Code Injection Praisonai Mervinpraison

9.4

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Network-reachable API with low complexity but PR:H because controlling agents_file needs privileged access; scope change (S:C) since injected code runs in a spawned subprocess, with full C/I/A impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 10, 2026 - 16:16 EUVD

Analysis Generated

Jul 10, 2026 - 15:32 vuln.today

DescriptionCVE.org

PraisonAI versions before 4.6.78 contain a code injection vulnerability in deploy/api.py where the agents_file parameter is directly interpolated into an f-string without sanitization. Attackers can inject arbitrary Python code that executes when the generated server code runs via subprocess.Popen().

Articles & Coverage 2

News 6 New Python Vulnerabilities - 1 Critical, 5 High, 1 With POC Jul 11, 2026 News Critical RCE in PraisonAI before 4.6.78 - CVE-2026-61444 Jul 10, 2026

AnalysisAI

Remote code execution in PraisonAI before 4.6.78 lets an attacker who can supply the agents_file parameter to deploy/api.py run arbitrary Python, because that value is interpolated directly into an f-string that is later executed as generated server code via subprocess.Popen(). The CVSS 4.0 base score is 9.4 and the vector requires high privileges (PR:H), meaning the attacker must already be able to reach and drive the deployment API. No public exploit has been identified at time of analysis and it is not on the CISA KEV list.

Technical ContextAI

PraisonAI is an open-source Python framework for building and orchestrating multi-agent LLM systems (mervinpraison/praisonai). Its deployment component (deploy/api.py) programmatically generates server code and launches it as a child process with subprocess.Popen(). The root cause is CWE-94 (Improper Control of Generation of Code, i.e. code injection): the user-controlled agents_file value is concatenated into a Python f-string template with no sanitization, escaping, or allow-listing, so any Python expression or statement embedded in that value becomes part of the emitted program and is executed when the generated script runs. This is a classic template/eval-style injection where the trust boundary between configuration input and executable code is not enforced.

RemediationAI

Vendor-released patch: 4.6.78 - upgrade PraisonAI to 4.6.78 or later, which is the primary and recommended fix (see GHSA-g6j7-pffp-8whg). If you cannot upgrade immediately, restrict who can reach and invoke the deploy/api.py deployment endpoint to trusted operators only and treat the agents_file parameter as untrusted input: validate it against a strict allow-list of known file paths and reject any value containing Python syntax, quotes, or newlines, accepting that this narrows legitimate flexibility in specifying agent definitions. As a further compensating control, run the generated server process under a low-privilege, sandboxed account so a successful injection cannot pivot to broader system compromise, at the cost of some deployment convenience. Refer to the vendor advisory (https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-g6j7-pffp-8whg) and the VulnCheck writeup (https://www.vulncheck.com/advisories/praisonai-before-code-injection-via-f-string) for confirmation of the fixed version.