PT-2026-60137 · Mervinpraison · Praisonai

Rexpository · Publicado 2026-07-15 · Atualizado 2026-07-15 · CVE-2026-61433

NVD

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Python source code for API servers. Attackers can inject arbitrary Python expressions through the deploy.api.host and agents file configuration parameters that execute when the generated server starts or handles requests.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2026-61433

Produtos afetados

Praisonai

Referências · 4

• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-79fv-7hq9-w7xg · Aviso do Fabricante
• https://github.com/MervinPraison/PraisonAI/commit/1620b49f36945d8cc8ee5635b906c960df5097a0 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-61433 · Nota de Segurança
• https://vulncheck.com/advisories/praisonai-before-code-injection-via-api-deployment-generator · Nota