PT-2026-57196 · Praisonai · Praisonai

Anushkavirgaonkar · Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-61444

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.78

Description A code injection issue exists in the deploy/api.py file. The agents file parameter is directly interpolated into an f-string without proper sanitization. This interpolated string is used to generate server code that is subsequently executed via the subprocess.Popen() function. An authorized user with access to the deploy API can exploit this to inject and execute arbitrary Python code within the context of the deployment process.

Recommendations Update PraisonAI to version 4.6.78. Avoid using the agents file parameter in the deploy/api.py endpoint until the update is applied.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-61444

Affected Products

Praisonai

References · 5

• 🔥 https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-g6j7-pffp-8whg · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-61444 · Security Note
• https://vulncheck.com/advisories/praisonai-before-code-injection-via-f-string · Note
• https://twitter.com/OrizonCyber/status/2075641220718543101 · Twitter Post
• https://twitter.com/UpwindMDR/status/2075611709083881717 · Twitter Post