Which versions of PraisonAI are affected by CVE-2026-61447?

PraisonAI versions before 1.6.78 contain a critical remote code execution vulnerability in the CodeAgent component that allows attackers to execute arbitrary Python code and exfiltrate all…. A patch is available.

Is there a public PoC exploit available for CVE-2026-61447?

Yes, a public proof-of-concept exploit is available for CVE-2026-61447. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-61447?

Within 24 hours: Inventory all PraisonAI deployments across the infrastructure and determine whether CodeAgent functionality is actively used; disable CodeAgent if operationally feasible. Within 7 days: Implement network isolation and air-gapping for remaining PraisonAI instances, restrict environment variable exposure, enforce least-privilege service account permissions, and audit system logs for indicators of unauthorized code execution. Within 30 days: Monitor PraisonAI vendor security advisories and CISA channels for patch availability; establish rapid deployment process to apply patches immediately upon release; contact vendor directly regarding timeline and interim guidance.

PraisonAI CVE-2026-61447

Q: What is the CVSS score of CVE-2026-61447?

CVE-2026-61447 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-43182 CRITICAL

Code Injection (CWE-94)

2026-07-11 VulnCheck

GHSA-mhgx-w3w5-2rvc

RCE Python Code Injection Praisonai Mervinpraison

10.0

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.0 CRITICAL

Network-reachable and unauthenticated (AV:N/PR:N) but reliant on influencing non-deterministic LLM output, so AC:H; sandbox-less host execution breaks scope (S:C) with full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 11, 2026 - 15:01 EUVD

Analysis Generated

Jul 11, 2026 - 13:54 vuln.today

DescriptionCVE.org

PraisonAI before 1.6.78 contains a remote code execution vulnerability in CodeAgent._execute_python() that executes LLM-generated Python code without AST validation, import restrictions, or sandbox enforcement. Attackers can influence LLM output through prompt injection to exfiltrate all environment secrets and execute arbitrary code on the host system.

Articles & Coverage 1

News Critical RCE in PraisonAI CodeAgent before 1.6.78 - CVE-2026-61447 Jul 11, 2026

AnalysisAI

Remote code execution in PraisonAI before 1.6.78 allows attackers to run arbitrary Python on the host by manipulating the LLM that drives the CodeAgent component. Because CodeAgent._execute_python() runs LLM-generated code with no AST validation, import restrictions, or sandbox, an attacker who can shape model output via prompt injection can exfiltrate all environment secrets and gain full control of the agent host. VulnCheck reports the flaw with a maximum CVSS 4.0 score of 10.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

PraisonAI is a multi-agent AI orchestration framework (Python, distributed as the mervinpraison/praisonai package) whose CodeAgent feature lets an LLM author and execute Python to accomplish tasks. The vulnerability is CWE-94 (Improper Control of Generation of Code / code injection): the _execute_python() routine passes model-generated source straight into the Python interpreter without an allow-list AST walk, without restricting dangerous imports (os, subprocess, socket), and without any process or OS sandbox. In agentic designs the LLM's output is data influenced by upstream, potentially untrusted context (documents, tool results, user messages), so any content that reaches the model can steer the generated code - turning prompt injection into direct code execution on the host.

RemediationAI

Vendor-released patch: upgrade to PraisonAI 1.6.78 or later, the first fixed release per the GitHub Security Advisory (https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-2xv2-w8cq-5gxw). If immediate upgrade is not possible, disable the CodeAgent code-execution path so the framework does not run LLM-generated Python - this removes the automated-coding feature but eliminates the RCE - and run any agent that must execute code inside a locked-down sandbox: an isolated container or VM with no outbound network, dropped privileges, and no access to production credentials. Additionally, strip secrets from the process environment and inject them only through a broker the agent cannot read, and treat all documents, tool outputs, and user messages that reach the model as untrusted to shrink the prompt-injection surface. The trade-off of the disable/sandbox controls is loss of dynamic code-execution functionality and added operational complexity; credential isolation limits blast radius but does not stop code execution itself.