CVE-2026-60086: PraisonAI injection filter bypass

CISO Take

PraisonAI's built-in prompt injection defense only blocks inputs its detector ensemble scores as CRITICAL, which requires three or more independent detector families to fire on the same input simultaneously — so a single well-crafted injection, or one combining just two vectors, is scored HIGH and passed straight through to the underlying LLM unfiltered. This isn't a novel attack technique, it's a broken control: the guardrail an operations team believes is stopping prompt injection actually has a wide, predictable blind spot that any attacker who tests a few payload variants against the open-source detector logic can find. There's no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template yet, so this looks like a design-flaw disclosure rather than an actively weaponized bug — but PraisonAI is an agent framework, meaning a bypassed injection can translate directly into unauthorized tool calls, not just a bad chatbot response. Upgrade to PraisonAI 4.6.78 or later immediately; until then, do not rely on the built-in classifier as your sole control — pair it with an independent prompt-injection detector (e.g., a dedicated guardrails library) and constrain what the agent's tools can do regardless of input trust level.

Sources: NVD GitHub Advisory ATLAS vulncheck.com

What is the risk?

Medium severity (CVSS 5.3) reflects low direct confidentiality/integrity/availability impact from the CVE description alone, but this understates real-world risk in agentic deployments: the vulnerability is a defense-evasion flaw in the exact control meant to stop prompt injection, and PraisonAI is specifically an agent framework where a successful injection can trigger tool invocation, not just influence text output. Exploitation requires no authentication, no user interaction, and only network access with low attack complexity (AV:N/AC:L/PR:N/UI:N) — the barrier is knowledge of the detector's threshold logic, which is discoverable from the open-source codebase itself. No KEV listing, EPSS score, or public PoC exists yet, so there's no evidence of active exploitation, but the low complexity and public advisory (GHSA-4r3p-w3mc-5v34) make weaponization straightforward once attackers study the fix diff.

How does the attack unfold?

Entry point

Attacker submits a crafted prompt to a PraisonAI-powered agent interface, needing no authentication or user interaction.

AML.T0049

Defense evasion

The payload uses only one or two injection vectors, causing the detector ensemble to score it HIGH instead of CRITICAL and pass unblocked.

AML.T0107

Injection reaches model

The unfiltered injected instructions reach the underlying LLM's context and influence its behavior.

AML.T0051

Impact

The agent may act on the injected instructions, including invoking connected tools beyond the legitimate user's intent.

AML.T0053

Entry point

Attacker submits a crafted prompt to a PraisonAI-powered agent interface, needing no authentication or user interaction.

AML.T0049

Defense evasion

The payload uses only one or two injection vectors, causing the detector ensemble to score it HIGH instead of CRITICAL and pass unblocked.

AML.T0107

Injection reaches model

The unfiltered injected instructions reach the underlying LLM's context and influence its behavior.

AML.T0051

Impact

The agent may act on the injected instructions, including invoking connected tools beyond the legitimate user's intent.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents 66% patched ~14d to patch Full package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 29% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I Low

A None

What should I do?

1 step

Upgrade to PraisonAI >= 4.6.78, which fixes the CRITICAL-only blocking threshold. Until patched, do not treat the built-in classifier as a complete control: add a second, independent injection/guardrails layer (e.g., NeMo Guardrails, Guardrails AI, or a dedicated prompt-injection classifier) in front of or alongside PraisonAI's agent inputs. Apply least-privilege scoping to any tools the agent can invoke so a successful injection has limited blast radius regardless of detection. Log and alert on inputs scored HIGH (not just CRITICAL) by the existing detector to catch near-miss injection attempts, and review any external/untrusted content sources feeding agent context (RAG documents, scraped pages, email/webhook payloads) for injection indicators.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Prompt Injection Agent Framework AML.T0051 - LLM Prompt Injection AML.T0053 - AI Agent Tool Invocation AML.T0065 - LLM Prompt Crafting AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.4 - AI system verification and validation

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM01:2025 - Prompt Injection

Frequently Asked Questions

What is CVE-2026-60086?

PraisonAI's built-in prompt injection defense only blocks inputs its detector ensemble scores as CRITICAL, which requires three or more independent detector families to fire on the same input simultaneously — so a single well-crafted injection, or one combining just two vectors, is scored HIGH and passed straight through to the underlying LLM unfiltered. This isn't a novel attack technique, it's a broken control: the guardrail an operations team believes is stopping prompt injection actually has a wide, predictable blind spot that any attacker who tests a few payload variants against the open-source detector logic can find. There's no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template yet, so this looks like a design-flaw disclosure rather than an actively weaponized bug — but PraisonAI is an agent framework, meaning a bypassed injection can translate directly into unauthorized tool calls, not just a bad chatbot response. Upgrade to PraisonAI 4.6.78 or later immediately; until then, do not rely on the built-in classifier as your sole control — pair it with an independent prompt-injection detector (e.g., a dedicated guardrails library) and constrain what the agent's tools can do regardless of input trust level.

Is CVE-2026-60086 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-60086, increasing the risk of exploitation.

How to fix CVE-2026-60086?

Upgrade to PraisonAI >= 4.6.78, which fixes the CRITICAL-only blocking threshold. Until patched, do not treat the built-in classifier as a complete control: add a second, independent injection/guardrails layer (e.g., NeMo Guardrails, Guardrails AI, or a dedicated prompt-injection classifier) in front of or alongside PraisonAI's agent inputs. Apply least-privilege scoping to any tools the agent can invoke so a successful injection has limited blast radius regardless of detection. Log and alert on inputs scored HIGH (not just CRITICAL) by the existing detector to catch near-miss injection attempts, and review any external/untrusted content sources feeding agent context (RAG documents, scraped pages, email/webhook payloads) for injection indicators.

What systems are affected by CVE-2026-60086?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, AI agent tool orchestration.

What is the CVSS score for CVE-2026-60086?

CVE-2026-60086 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.36%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesAI agent tool orchestration

MITRE ATLAS Techniques

AML.T0051 LLM Prompt Injection

AML.T0053 AI Agent Tool Invocation

AML.T0065 LLM Prompt Crafting

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.4

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM01:2025

What are the technical details?

Original Advisory

PraisonAI before 4.6.78 contains a prompt injection defense bypass vulnerability where the injection defense only blocks threats classified as CRITICAL, requiring three or more detector families to match simultaneously. Attackers can craft single or double-vector prompt injections that are classified as HIGH threat level and pass through unblocked to reach the model.

Exploitation Scenario

An attacker targets a customer-facing or internal PraisonAI agent that has access to sensitive tools (email, file access, or internal APIs). Instead of a single obvious jailbreak attempt that would trigger three-plus detector families and get blocked as CRITICAL, the attacker crafts a payload using only one or two injection vectors — for example, combining a role-override instruction with light obfuscation but omitting a third detectable pattern. The defense scores it HIGH, which the library does not block, and the payload reaches the LLM's context unfiltered. The agent then follows the injected instructions, potentially invoking a connected tool (e.g., sending data externally or executing an unintended action) that the attacker specified, all without needing valid credentials or user interaction beyond delivering the input.

Weaknesses (CWE)

CWE-693 Protection Mechanism Failure Primary CWE-693 Protection Mechanism Failure

CWE-693 — Protection Mechanism Failure: The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Source: MITRE CWE corpus.