CVE-2026-61445
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
PraisonAI before version 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component. Missing path validation and command sanitization in LLM tool calls allow attackers to inject malicious prompts through the chat interface.
Risk Assessment
An attacker can write files to arbitrary filesystem locations and execute arbitrary shell commands with root privileges, leading to full server compromise.
Recommendation
Immediately update PraisonAI to version 4.6.78 or later. Implement additional path validation and command sanitization in the AICoder component.
Original NVD description (English source)
PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component due to missing path validation and command sanitization in LLM tool calls. Attackers can inject malicious prompts through the chat interface to write files to arbitrary filesystem locations and execute arbitrary shell commands with root privileges.