CVE-2026-61447: PraisonAI before 1.6.78 Remote Code Execution via CodeAgent
PraisonAI before 1.6.78 contains a remote code execution vulnerability in CodeAgent.executepython() that executes LLM-generated Python code without AST validation, import restrictions, or sandbox enforcement. Attackers can influence LLM output through prompt injection to exfiltrate all environment secrets and execute arbitrary code on the host system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PraisonAIto a version that resolves this vulnerability.Fixed in 1.6.78
Event History
Frequently Asked Questions
What is the severity of CVE-2026-61447?
CVE-2026-61447 has a critical severity rating of 10.
How do I fix CVE-2026-61447?
To fix CVE-2026-61447, upgrade PraisonAI to version 1.6.78 or later.
What type of vulnerability is identified in CVE-2026-61447?
CVE-2026-61447 is a remote code execution vulnerability due to code injection.
What are the potential impacts of CVE-2026-61447?
Exploitation of CVE-2026-61447 can lead to unauthorized access and control over the affected system.
Which component of PraisonAI is affected by CVE-2026-61447?
CVE-2026-61447 affects the CodeAgent._execute_python() function in PraisonAI.