CVE-2026-61444
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
PraisonAI before version 4.6.78 contains a code injection vulnerability in deploy/api.py where the agents_file parameter is directly interpolated into an f-string without sanitization. Attackers can inject arbitrary Python code that executes when the generated server code runs via subprocess.Popen().
Risk Assessment
The risk for the organization includes remote code execution (RCE) on the server, which can lead to system compromise, data theft, or further attacks on the infrastructure.
Recommendation
It is recommended to immediately upgrade PraisonAI to version 4.6.78 or later. Also check for any unauthorized access or system modifications.
Original NVD description (English source)
PraisonAI versions before 4.6.78 contain a code injection vulnerability in deploy/api.py where the agents_file parameter is directly interpolated into an f-string without sanitization. Attackers can inject arbitrary Python code that executes when the generated server code runs via subprocess.Popen().