PT-2026-60133 · Mervinpraison · Praisonai

Lhmisme420 · Publicado 2026-07-15 · Atualizado 2026-07-15 · CVE-2026-60085

Mitre

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

PraisonAI before 4.6.78 contains an unenforced security policy vulnerability in the default Subprocess Sandbox backend where blocked commands, blocked paths, blocked imports, allow subprocess, and allow file write restrictions are completely ignored. Attackers can execute arbitrary subprocess commands, read sensitive files, and perform destructive operations despite explicit security policy configuration.

Correção

Enumeração de Fraquezas

CWE-273

Identificadores relacionados

CVE-2026-60085

Produtos afetados

Praisonai

Referências · 3

• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-5r6c-gj4g-r697 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-60085 · Nota de Segurança
• https://vulncheck.com/advisories/praisonai-before-unenforced-security-policy-in-subprocess-sandbox · Nota