PT-2026-60137 · Mervinpraison · Praisonai

Rexpository · Published 2026-07-15 · Updated 2026-07-15 · CVE-2026-61433

NVD

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Python source code for API servers. Attackers can inject arbitrary Python expressions through the deploy.api.host and agents file configuration parameters that execute when the generated server starts or handles requests.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-61433

Affected Products

Praisonai

References · 4

• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-79fv-7hq9-w7xg · Vendor Advisory
• https://github.com/MervinPraison/PraisonAI/commit/1620b49f36945d8cc8ee5635b906c960df5097a0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-61433 · Security Note
• https://vulncheck.com/advisories/praisonai-before-code-injection-via-api-deployment-generator · Note