Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-61438 · GHSA-26mh-57q7-jfvr

PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox

Risk score
59/100
CVSS
7.3 v3.1
Exploit chance (30 days)
0.3%
Published
15 Jul 2026

Open in the live forecast Today's forecast

What to know

What it is
PraisonAI before 4.6.78 contains a remote code execution vulnerability in JobWorkflowExecutor._exec_inline_python() due to insufficient AST validation of workflow script steps. Attackers can create malicious YAML workflow files with import os statements followed by os.system() calls that bypass sandbox checks and exec…
Affected
praisonai (pip) < 4.6.78
Fix
Upgrade praisonai to 4.6.78 or later.
Exploitation
Public proof of concept

Story map

Story map: praisonaiTHE FLAWSTHE FIXCVE-2026-61438PraisonAI vulnerable toRemote Code Execution viaBroken AST SandboxCVSS 7.3 · EPSS 0%CVE-2026-61445PraisonAI: AICoder ArbitraryFile Write and CommandExecution via LLM Tool CallsCVSS 9.9 · EPSS 1%CVE-2026-61426PraisonAI: AgentOS defaults tonetwork-exposed no-authmode, allowing…CVSS 8.6 · EPSS 0%CVE-2026-61434PraisonAI: Shell commandallowlist bypass via find -execbuilt-in actionCVSS 8.8 · EPSS 1%Upgrade praisonai4.6.78 · 1.7.3or later on your release lineWho is exposedpraisonai (pip) <= 4.6.77AMBER · PATCH THIS WEEKpraisonaiPraisonAI before 4.6.78contains arbitrary file write andcommand executionvulnerabilities in the AICodercomponent due to missing pathvalidation and commandsanitization in LLM tool calls.…Where it standsPublic proof of conceptCONNECTS TOSame weaknessOS command injection (CWE-78)376 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

praisonai: Amber, patch this week. PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component due to missing path validation and command sanitization in LLM tool calls. Attackers can inject malicious prompts through the chat interface to write files to arbitrary filesystem locations and execute …

The flaws

  • CVE-2026-61438: PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox (CVSS 7.3 · EPSS 0%)
  • CVE-2026-61445: PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls (CVSS 9.9 · EPSS 1%)
  • CVE-2026-61426: PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure (CVSS 8.6 · EPSS 0%)
  • CVE-2026-61434: PraisonAI: Shell command allowlist bypass via find -exec built-in action (CVSS 8.8 · EPSS 1%)

The fix

Upgrade praisonai: 4.6.78 · 1.7.3 or later on your release line

Who is exposed: praisonai (pip) <= 4.6.77

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 7.3 high
  • Public exploit or proof of concept referenced
  • On your watchlist: PyPI

Affected packages

PackageEcosystemVulnerableFixed in
praisonaipip< 4.6.784.6.78

References

Original description

PraisonAI before 4.6.78 contains a remote code execution vulnerability in JobWorkflowExecutor._exec_inline_python() due to insufficient AST validation of workflow script steps. Attackers can create malicious YAML workflow files with import os statements followed by os.system() calls that bypass sandbox checks and execute arbitrary OS commands with process privileges.

Last activity 29 Oct 2026. Patch Forecast updates every hour.