What is the CVSS score of CVE-2026-62176?

CVE-2026-62176 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of PraisonAI are affected by CVE-2026-62176?

PraisonAI's deploy tooling (all versions through 4.6.77) contains a critical code-injection flaw that lets a privileged actor who controls the agents_file configuration value execute arbitrary code…. A patch is available.

How to fix or mitigate CVE-2026-62176?

Within 24 hours, inventory every internal use of PraisonAI's deploy tooling and confirm which installations are on 4.6.77 or earlier, identify any CI/CD pipeline or shared build environment where the agents_file value can be set or influenced by anyone outside a small trusted group, and temporarily suspend or gate those pipelines until remediation is complete. Within 7 days, upgrade all affected instances to the vendor-released 4.6.78, redeploy from clean build hosts, rotate credentials, registry tokens, and signing keys that were present on any host running the deploy command, and review recent build and deployment logs and generated artifacts for unexpected commands, outbound connections, or unexplained changes. Within 30 days, harden the build path by running deploy steps in ephemeral, least-privilege, network-restricted containers with no access to production secrets, add input validation and allow-listing for agents_file and similar configuration values, and fold vendor patch tracking for build and deployment tooling into standard vulnerability management so future fixes are applied on a defined SLA.

PraisonAI CVE-2026-62176

EUVD-2026-94521 CRITICAL

Code Injection (CWE-94)

2026-10-07 https://github.com/MervinPraison/PraisonAI

GHSA-g6j7-pffp-8whg

RCE Python Docker Code Injection

9.1

CVSS 3.1 · Vendor: https://github.com/MervinPraison/PraisonAI

Severity by source

Vendor (https://github.com/MervinPraison/PraisonAI) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

6.7 MEDIUM

Attacker must control deploy-time agents_file input (config/CLI), so AV:L and PR:H; injected code runs in the same context yielding full C/I/A impact with no scope change (S:U).

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/MervinPraison/PraisonAI).

CVSS VectorVendor: https://github.com/MervinPraison/PraisonAI

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

POC Analysis Generated

Oct 07, 2026 - 19:24 vuln.today

Patch available

Oct 07, 2026 - 18:02 EUVD

Analysis Generated

Oct 07, 2026 - 16:36 vuln.today

CVE Published

Oct 07, 2026 - 16:05 github-advisory

CRITICAL 9.1

DescriptionCVE.org

Summary

The deploy/api.py module generates Python server code by directly interpolating the agents_file parameter into an f-string that is then written to a file and executed via subprocess.Popen(). An attacker who controls the agents_file value (via CLI argument, configuration, or upstream API) can inject arbitrary Python code.

Details

src/praisonai/praisonai/deploy/api.py (line 80):

python

code = f'''...
    praisonai = PraisonAI(agent_file="{agents_file}")
...
    "agent_file": "{agents_file}"
...'''

The generated code is then executed (line 190):

python

subprocess.Popen(['python', server_file])

agents_file is never sanitized or validated. A malicious value breaks out of the string context:

python

agents_file = '"); import os; os.system("id"); #'
# Generated code becomes:
# praisonai = PraisonAI(agent_file=""); import os; os.system("id"); #")

The same pattern exists in deploy/docker.py (line 33) for Dockerfile generation.

PoC

python

# The injection:
agents_file = '"); import os; os.system("id"); #'
# What the generated code looks like:
template = f'praisonai = PraisonAI(agent_file="{agents_file}")'
print(template)
# Output: praisonai = PraisonAI(agent_file=""); import os; os.system("id"); #")

Impact

Arbitrary code execution on the machine running the deploy command
Supply chain risk if agents_file comes from a configuration file or CI/CD pipeline

Articles & Coverage 2

News 4 New Python Vulnerabilities - 2 Critical, 2 High Severity Oct 08, 2026 News Critical Python Code Injection in PraisonAI Deploy Tooling - CVE-2026-62176 Oct 07, 2026

AnalysisAI

Python code injection in PraisonAI's deploy tooling (all versions up to and including 4.6.77) lets a high-privileged actor who controls the agents_file value break out of an f-string and execute arbitrary code on the host running the deploy command. The flaw is triggered at build/deploy time: the unsanitized value is interpolated into generated server or Dockerfile source in deploy/api.py and deploy/docker.py, written to disk, and then launched via subprocess.Popen(['python', server_file]), so the primary realistic exposure is CI/CD pipelines or shared build environments where agents_file originates from externally influenced configuration. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires the attacker to control the `agents_file` parameter consumed by PraisonAI's deploy code-generation path in `src/praisonai/praisonai/deploy/api.py` (and the equivalent Dockerfile generation in `deploy/docker.py`) - supplied as a CLI argument, from a configuration file, or from an upstream API - and the `praisonai deploy` command must actually be executed, at which point the generated file is run via subprocess.Popen(['python', server_file]). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a CWE-94 Python code-injection flaw in PraisonAI's deploy tooling where the unsanitized `agents_file` value is interpolated into an f-string that is written out and executed via subprocess.Popen(). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	The primary fix is to upgrade PraisonAI to the vendor-released patched version, 4.6.78 or later, which removes the direct f-string interpolation of `agents_file` in both `deploy/api.py` and `deploy/docker.py`; installs should be pinned by exact version in requirements files, lockfiles, and container base images so that CI rebuilds pick up the fixed release rather than resolving back to a vulnerable pin. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory every internal use of PraisonAI's deploy tooling and confirm which installations are on 4.6.77 or earlier, identify any CI/CD pipeline or shared build environment where the agents_file value can be set or influenced by anyone outside a small trusted group, and temporarily suspend or gate those pipelines until remediation is complete. …

Threat intelligence, references, and detailed analysis are available after sign-in.