PT-2026-57439 · Praisonai · Praisonai

Anushkavirgaonkar · Published 2026-07-11 · Updated 2026-07-11 · CVE-2026-61445

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.78

Description The AICoder component contains flaws allowing arbitrary file write and command execution. These issues result from missing path validation and inadequate command sanitization during Large Language Model (LLM) tool calls. An attacker can use the chat interface to inject malicious prompts, enabling them to write files to any location on the filesystem and execute shell commands with root privileges.

Recommendations Update PraisonAI to version 4.6.78.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-61445

GHSA-9MP3-24CC-77MG

Affected Products

Praisonai

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61445.json · Exploit
• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-9mp3-24cc-77mg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-61445 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-61445 · Security Note
• https://twitter.com/UpwindMDR/status/2076008371426148641 · Twitter Post
• https://twitter.com/OrizonCyber/status/2075988519709811181 · Twitter Post
• https://vulncheck.com/advisories/praisonai-before-arbitrary-file-write-and-command-execution · Note
• https://reddit.com/r/pwnhub/comments/1utqqs1/critical_remote_code_execution_vulnerability_in · Reddit Post
• https://twitter.com/vuldb/status/2075985519654449487 · Twitter Post
• https://twitter.com/CVEnew/status/2075976712127426624 · Twitter Post