Patch Forecast
Amber warning
Patch this week.

CVE-2026-61446 · GHSA-m6wp-h223-4c8g

PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification

Risk score
65/100
CVSS
8.4 v3.1
Exploit chance (30 days)
0.3%
Published
15 Jul 2026

Open in the live forecast Today's forecast

What to know

What it is
PraisonAI (praisonaiagents) before 1.6.78 contains a remote code execution vulnerability in the plugin manager, which loads and executes arbitrary Python (.py) files from project-level and user-home .praisonai/plugins/ directories using importlib spec_from_file_location() and exec_module() without code signing, integr…
Affected
praisonaiagents (pip) <= 1.6.77
Fix
Upgrade praisonaiagents to 1.6.78 or later.
Exploitation
No known exploitation

Story map

Story map: praisonaiagentsTHE FLAWSTHE FIXCVE-2026-61446PraisonAI: PluginAuto-Discovery ExecutesArbitrary Python Files…CVSS 8.4 · EPSS 0%CVE-2026-61447PraisonAI: CodeAgent ExecutesLLM-Generated Code WithoutSandboxing and Leaks All…CVSS 10.0 · EPSS 2%CVE-2026-61430PraisonAI: DNS rebindingbypass in `web_crawl` SSRFprotection allows internal…CVSS 8.5 · EPSS 0%CVE-2026-61429PraisonAI:Crawl4AI/Chromium backend isalso affected by the…CVSS 8.5 · EPSS 0%Upgrade praisonaiagents1.6.78or later on your release lineWho is exposedpraisonaiagents (pip) <= 1.6.77RED · ACT TODAYpraisonaiagentsCodeAgent._execute_python()executes LLM-generated Pythoncode in a subprocess with thecomplete parent-processenvironment (os.environ.copy()),zero AST validation, zero importrestrictions, and no sandbox…Where it standsPublic proof of conceptCONNECTS TOSame weaknessCode injection (CWE-94)238 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

praisonaiagents: Red, act today. CodeAgent._execute_python() executes LLM-generated Python code in a subprocess with the complete parent-process environment (os.environ.copy()), zero AST validation, zero import restrictions, and no sandbox enforcement — even when CodeConfig(sandbox=True) is explicitly set. This allows an attacker who can influence LL…

The flaws

  • CVE-2026-61446: PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification (CVSS 8.4 · EPSS 0%)
  • CVE-2026-61447: PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets (CVSS 10.0 · EPSS 2%)
  • CVE-2026-61430: PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure (CVSS 8.5 · EPSS 0%)
  • CVE-2026-61429: PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass (CVSS 8.5 · EPSS 0%)

The fix

Upgrade praisonaiagents: 1.6.78 or later on your release line

Who is exposed: praisonaiagents (pip) <= 1.6.77

Where it stands

  • Public proof of concept

Connects to

Why it is Amber

  • CVSS 8.4 high
  • On your watchlist: python, PyPI

Affected packages

PackageEcosystemVulnerableFixed in
praisonaiagentspip<= 1.6.771.6.78

References

Original description

PraisonAI (praisonaiagents) before 1.6.78 contains a remote code execution vulnerability in the plugin manager, which loads and executes arbitrary Python (.py) files from project-level and user-home .praisonai/plugins/ directories using importlib spec_from_file_location() and exec_module() without code signing, integrity verification, or sandboxing. An attacker who can write a malicious .py file to a plugin directory (for example via path traversal, a supply chain attack, or a compromised dependency) achieves arbitrary code execution when the plugin system initializes.

Last activity 8 Oct 2026. Patch Forecast updates every hour.