Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-60085 · GHSA-5r6c-gj4g-r697

PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend

Risk score
58/100
CVSS
7.5 v3.1
Exploit chance (30 days)
0.3%
Published
15 Jul 2026

Open in the live forecast Today's forecast

What to know

What it is
PraisonAI before 4.6.78 contains an unenforced security policy vulnerability in the default Subprocess Sandbox backend where blocked_commands, blocked_paths, blocked_imports, allow_subprocess, and allow_file_write restrictions are completely ignored. Attackers can execute arbitrary subprocess commands, read sensitive …
Affected
praisonai (pip) <= 4.6.77
Fix
Upgrade praisonai to 4.6.78 or later.
Exploitation
No known exploitation

Story map

Story map: praisonaiTHE FLAWSTHE FIXCVE-2026-60085PraisonAI: SecurityPolicycommand/path/importrestrictions are completely…CVSS 7.5 · EPSS 0%CVE-2026-61445PraisonAI: AICoder ArbitraryFile Write and CommandExecution via LLM Tool CallsCVSS 9.9 · EPSS 1%CVE-2026-61426PraisonAI: AgentOS defaults tonetwork-exposed no-authmode, allowing…CVSS 8.6 · EPSS 0%CVE-2026-61435PraisonAI: Call APIlocalhost-only authenticationbypass via spoofed Host headerCVSS 8.2 · EPSS 1%Upgrade praisonai4.6.78or later on your release lineWho is exposedpraisonai (pip) <= 4.6.77AMBER · PATCH THIS WEEKpraisonaiThe AICoder UI componentexposes write_to_file andexecute_command tools to theLLM with no path validation andno command sanitization. Anattacker can achieve arbitraryfile write to any location on…Where it standsPublic proof of conceptCONNECTS TOSame weaknessCWE-273 (CWE-273)4 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

praisonai: Amber, patch this week. The AICoder UI component exposes write_to_file and execute_command tools to the LLM with no path validation and no command sanitization. An attacker can achieve arbitrary file write to any location on the filesystem (including /root/.ssh/authorized_keys, /etc/crontab) and arbitrary command execution through prompt inj…

The flaws

  • CVE-2026-60085: PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend (CVSS 7.5 · EPSS 0%)
  • CVE-2026-61445: PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls (CVSS 9.9 · EPSS 1%)
  • CVE-2026-61426: PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure (CVSS 8.6 · EPSS 0%)
  • CVE-2026-61435: PraisonAI: Call API localhost-only authentication bypass via spoofed Host header (CVSS 8.2 · EPSS 1%)

The fix

Upgrade praisonai: 4.6.78 or later on your release line

Who is exposed: praisonai (pip) <= 4.6.77

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 7.5 high
  • Remotely exploitable without logging in
  • On your watchlist: PyPI

Affected packages

PackageEcosystemVulnerableFixed in
praisonaipip<= 4.6.774.6.78

References

Original description

PraisonAI before 4.6.78 contains an unenforced security policy vulnerability in the default Subprocess Sandbox backend where blocked_commands, blocked_paths, blocked_imports, allow_subprocess, and allow_file_write restrictions are completely ignored. Attackers can execute arbitrary subprocess commands, read sensitive files, and perform destructive operations despite explicit security policy configuration.

Last activity 8 Oct 2026. Patch Forecast updates every hour.