Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-61433 · GHSA-79fv-7hq9-w7xg

PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source

Risk score
59/100
CVSS
7.8 v3.1
Exploit chance (30 days)
0.2%
Published
15 Jul 2026

Open in the live forecast Today's forecast

What to know

What it is
PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Python source code for API servers. Attackers can inject arbitrary Python expressions through the deploy.api.host and agents_file configuration parameters that execute when the generated server starts or handles requests.
Affected
praisonai (pip) <= 4.6.77
Fix
Upgrade praisonai to 4.6.78 or later.
Exploitation
No known exploitation

Story map

Story map: praisonaiTHE FLAWSTHE FIXCVE-2026-61433PraisonAI: API deploy codegenerator embeds unescapedYAML fields into Python sourceCVSS 7.8 · EPSS 0%CVE-2026-61445PraisonAI: AICoder ArbitraryFile Write and CommandExecution via LLM Tool CallsCVSS 9.9 · EPSS 1%CVE-2026-61426PraisonAI: AgentOS defaults tonetwork-exposed no-authmode, allowing…CVSS 8.6 · EPSS 0%CVE-2026-61435PraisonAI: Call APIlocalhost-only authenticationbypass via spoofed Host headerCVSS 8.2 · EPSS 1%Upgrade praisonai4.6.78or later on your release lineWho is exposedpraisonai (pip) <= 4.6.77AMBER · PATCH THIS WEEKpraisonaiThe AICoder UI componentexposes write_to_file andexecute_command tools to theLLM with no path validation andno command sanitization. Anattacker can achieve arbitraryfile write to any location on…Where it standsPublic proof of conceptCONNECTS TOSame weaknessCode injection (CWE-94)239 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

praisonai: Amber, patch this week. The AICoder UI component exposes write_to_file and execute_command tools to the LLM with no path validation and no command sanitization. An attacker can achieve arbitrary file write to any location on the filesystem (including /root/.ssh/authorized_keys, /etc/crontab) and arbitrary command execution through prompt inj…

The flaws

  • CVE-2026-61433: PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source (CVSS 7.8 · EPSS 0%)
  • CVE-2026-61445: PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls (CVSS 9.9 · EPSS 1%)
  • CVE-2026-61426: PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure (CVSS 8.6 · EPSS 0%)
  • CVE-2026-61435: PraisonAI: Call API localhost-only authentication bypass via spoofed Host header (CVSS 8.2 · EPSS 1%)

The fix

Upgrade praisonai: 4.6.78 or later on your release line

Who is exposed: praisonai (pip) <= 4.6.77

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 7.8 high
  • On your watchlist: python, PyPI

Affected packages

PackageEcosystemVulnerableFixed in
praisonaipip<= 4.6.774.6.78

References

Original description

PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Python source code for API servers. Attackers can inject arbitrary Python expressions through the deploy.api.host and agents_file configuration parameters that execute when the generated server starts or handles requests.

Last activity 8 Oct 2026. Patch Forecast updates every hour.