PT-2026-57437 · Praisonai · Praisonai

Chakrapani150 · Published 2026-07-11 · Updated 2026-07-11 · CVE-2026-61439

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.78

Description A prompt injection defense misconfiguration exists where the block threshold defaults to CRITICAL severity. This allows threats categorized as HIGH severity to pass through without being blocked. Attackers can utilize single-vector prompt injection attacks, such as instruction overrides or financial manipulation, which trigger HIGH severity detection but are only logged. This flaw enables the extraction of system prompts and unauthorized tool invocations.

Recommendations Update to version 4.6.78 or later.

Exploit

Fix

Weakness Enumeration

CWE-1188

Related Identifiers

CVE-2026-61439

GHSA-FJ8F-M44G-C479

Affected Products

Praisonai

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61439.json · Exploit
• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-fj8f-m44g-c479 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-61439 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-61439 · Security Note
• https://twitter.com/infoflowcloud/status/2075977427734392833 · Twitter Post
• https://vulncheck.com/advisories/praisonai-before-prompt-injection-defense-bypass · Note
• https://twitter.com/CVEnew/status/2075976715864592610 · Twitter Post
• https://twitter.com/MalwareObserver/status/2075991494477942838 · Twitter Post