CVE-2026-61432

A vulnerability in PraisonAI before version 4.6.78 allows bypassing the shell command allowlist by using find's built-in actions (-exec, -execdir, -delete). Attackers can execute unauthorized commands, read or delete files without triggering shell metacharacter filters.

PraisonAI before version 4.6.78 contains a path traversal vulnerability in the ContextGatherer component that fails to validate include paths in .praisoncontext and .praisoninclude files. Attackers can supply absolute paths or parent directory traversal sequences to read arbitrary files outside the workspace and include their contents in the generated context bundle.

PraisonAI before version 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the Jobs API /api/v1/runs endpoint. The webhook_url parameter is validated at request time but re-resolved at connection time, allowing attackers to use DNS rebinding to reach internal services with a blind SSRF attack.

A vulnerability in PraisonAI (praisonaiagents) before version 1.6.78 automatically loads defaults from a project-local .praisonai/config.toml without validating the output.output_file path. An attacker can set this path to an absolute or '..' traversal path, causing agent.start() without an output parameter to overwrite files outside the project root.

In the multi-agent system PraisonAI prior to version 4.6.37, a vulnerability allows the exploitation of symlinks to write arbitrary data to a chosen location on the victim's filesystem. The issue stems from the lack of validation for member.linkname and not rejecting symlink/hardlink members.

In the multi-agent system PraisonAI, versions from 4.5.139 to before 4.6.32 have a vulnerability related to unauthorized file imports. The tool_override.py file lacks safeguards, allowing remote code execution by an attacker.

In PraisonAI prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register GET /{path}/list, POST /{path}, and POST /{path}/{agent_id} without access-control checks before listing agents or calling agent.chat. A remotely exposed server can therefore let unauthenticated clients enumerate agents, consume model resources, access connected private context, and trigger agent tools or workflow side effects.

PraisonAI prior to version 4.6.78 has a vulnerability in the `deploy/api.py` module that generates Python server code by directly interpolating the `agents_file` parameter into an f-string, which is then written to a file and executed via `subprocess.Popen()`. An attacker who controls the `agents_file` value can inject arbitrary Python code.

In PraisonAI prior to 0.1.6, when PLATFORM_JWT_SECRET is unset, the public dev-secret-change-me HS256 signing key is used, and startup and token-issuance guards are disabled because PLATFORM_ENV defaults to dev. An unauthenticated attacker can sign a JWT with an arbitrary sub value that is accepted as an authenticated identity, enabling impersonation of a user or workspace owner.

In PraisonAI prior to 0.1.6, when PLATFORM_JWT_SECRET is unset, JWT_SECRET is assigned the public dev-secret-change-me value, and its production guard does not run when PLATFORM_ENV is also unset (defaults to dev). A remote unauthenticated attacker can mint an HS256 token with arbitrary sub and email, which is accepted by AuthService._verify_token() and get_current_user for protected API routes.