PraisonAI CVE-2026-61447

Exploitation requires that the target deployment uses PraisonAI's CodeAgent feature (the component containing _execute_python) and that the attacker can influence the LLM's context - i.e. some untrusted content (user prompt, retrieved document, tool/web result) reaches the model driving the agent. Given that, no authentication is indicated by the vector (PR:N/UI:N) and default CodeAgent configurations perform no AST validation, import filtering, or sandboxing, so nothing further limits code execution. The practical limiting factors are: the CodeAgent code-execution mode must be in use (not all PraisonAI deployments enable it), the attacker needs a path into the model input, and reliable triggering depends on the LLM actually emitting the injected code, which is probabilistic though readily achievable via prompt injection.

All available signals point to genuine high priority rather than an inflated score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation, and the vulnerable-system and subsequent-system impacts are all High (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) yielding the maximum 10.0 - consistent with full host compromise and secret theft. The realistic constraint not captured by the raw score is dependence on LLM behavior: exploitation requires an attacker-controllable path into the model's context and relies on the (non-deterministic but readily coaxed) model emitting the malicious code, which is why an assessed CVSS 3.1 could justify AC:H even though 4.0 rates AC:L. No EPSS score was provided, the CVE is not in CISA KEV, and no POC is referenced, so there is no evidence of active or widespread exploitation yet; the risk is driven by the trivial post-injection impact and the design pattern, not by observed in-the-wild activity.

An attacker plants injection text in content the agent will process - a web page, uploaded file, or chat message - instructing the model to write Python that reads os.environ and opens a reverse shell. When the CodeAgent generates and calls _execute_python(), the unsandboxed code runs on the host, exfiltrating API keys and giving the attacker command execution. No exploit code is publicly identified at time of analysis, but the network attack vector and low complexity make the path straightforward once model input is attacker-influenced.