PT-2026-60142 · Mervinpraison · Praisonai

Publicado 2026-07-15 · Atualizado 2026-07-15 · CVE-2026-61443

NVD

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

PraisonAI before 1.6.78 contains a remote code execution vulnerability in SkillTools.run skill script() that executes scripts without path containment validation. Attackers can supply absolute file paths to execute arbitrary scripts from any filesystem location, including those outside the intended working directory.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-61443

Produtos afetados

Praisonai

Referências · 3

• 🔥 https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-c44f-37qr-gw3f · Exploit
• https://vulncheck.com/advisories/praisonai-before-remote-code-execution-via-skilltools · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-61443 · Nota de Segurança