CVE-2026-61434: PraisonAI allowlist bypass enables

Q: Is CVE-2026-61434 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-61434, increasing the risk of exploitation.

Q: How to fix CVE-2026-61434?

Upgrade PraisonAI to version 4.6.78 or later immediately, where the allowlist logic accounts for find's built-in actions. If immediate patching isn't possible, disable or heavily restrict the shell/command-execution tool for agents that accept untrusted input, and explicitly strip or reject find invocations containing -exec, -execdir, -delete, -fprintf, or similar built-in actions at the tool-invocation layer rather than relying solely on shell metacharacter filtering. Run agent shell tools inside a sandboxed, least-privilege environment (container, restricted user, read-only filesystem where possible) so that even a successful allowlist bypass cannot reach sensitive files or binaries. For detection, monitor agent tool-invocation logs for find commands containing these flags, and alert on any unexpected file deletions or executions originating from the agent runtime.

Q: What systems are affected by CVE-2026-61434?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks.

Q: What is the CVSS score for CVE-2026-61434?

CVE-2026-61434 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.73%.

CISO Take

PraisonAI's command-execution guardrail filters shell metacharacters but fails to account for find's built-in -exec, -execdir, and -delete actions, letting an attacker run arbitrary binaries, read blocked files, or delete data without ever triggering the blocklist. The CVSS 8.8 score reflects the full compromise potential — confidentiality, integrity, and availability all rated high — and the attack requires only low privileges, no user interaction, and low complexity, making it trivially reachable by anyone who can get PraisonAI's agent to execute a crafted find command. There is no EPSS data, no known public exploit, and it is not in CISA KEV, so this is not yet under active exploitation, but the technique is well-documented (GitHub Security Advisory GHSA-cv3g-hj65-pcfh, VulnCheck advisory) and trivially reproducible once known. Any deployment where PraisonAI executes LLM-generated or user-supplied shell commands against an allowlist should treat this as a priority patch. Upgrade to PraisonAI 4.6.78 or later immediately, and in the interim audit logs for find invocations containing -exec, -execdir, or -delete flags.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

High risk for any deployment that relies on PraisonAI's shell-command allowlist as a security boundary. The vulnerability is a logic flaw, not a memory-safety or dependency issue, so exploitation is deterministic and reliable once an attacker crafts the right find invocation — there is no fuzzing or timing dependency. Attack complexity is low and no user interaction is required, meaning any component that passes attacker- or LLM-influenced input into the allowlisted shell executor is exposed. The absence of EPSS scoring and KEV listing suggests exploitation has not yet been observed in the wild, but the public advisory and clear reproduction steps significantly lower the bar for weaponization, so the real-world exploitation window should be assumed to be short.

How does the attack unfold?

Initial Access

Attacker gains ability to influence input to a PraisonAI agent's shell command tool, either as a direct low-privileged user or via indirect prompt injection.

AML.T0053

Defense Evasion

Attacker crafts a find command using built-in -exec, -execdir, or -delete actions that evades the shell metacharacter allowlist filter.

AML.T0050

Execution

The bypassed allowlist permits the agent to run the embedded command, reading blocked files or invoking non-allowlisted binaries.

AML.T0102

Impact

Attacker achieves data exfiltration (reading secrets/config), data destruction (via -delete), or arbitrary code execution within the agent's runtime privileges.

AML.T0101

Initial Access

Attacker gains ability to influence input to a PraisonAI agent's shell command tool, either as a direct low-privileged user or via indirect prompt injection.

AML.T0053

Defense Evasion

Attacker crafts a find command using built-in -exec, -execdir, or -delete actions that evades the shell metacharacter allowlist filter.

AML.T0050

Execution

The bypassed allowlist permits the agent to run the embedded command, reading blocked files or invoking non-allowlisted binaries.

AML.T0102

Impact

Attacker achieves data exfiltration (reading secrets/config), data destruction (via -delete), or arbitrary code execution within the agent's runtime privileges.

AML.T0101

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	<= 4.6.77	`4.6.78`
1 dependents61% patched~23d to patchFull package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 54% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

Upgrade PraisonAI to version 4.6.78 or later immediately, where the allowlist logic accounts for find's built-in actions. If immediate patching isn't possible, disable or heavily restrict the shell/command-execution tool for agents that accept untrusted input, and explicitly strip or reject find invocations containing -exec, -execdir, -delete, -fprintf, or similar built-in actions at the tool-invocation layer rather than relying solely on shell metacharacter filtering. Run agent shell tools inside a sandboxed, least-privilege environment (container, restricted user, read-only filesystem where possible) so that even a successful allowlist bypass cannot reach sensitive files or binaries. For detection, monitor agent tool-invocation logs for find commands containing these flags, and alert on any unexpected file deletions or executions originating from the agent runtime.

How is it classified?

Code ExecutionAuth BypassAgentFrameworkAML.T0050- Command and Scripting Interpreter AML.T0053- AI Agent Tool Invocation AML.T0101- Data Destruction via AI Agent Tool Invocation AML.T0102- Generate Malicious Commands

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2.3-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Mechanisms for managing AI system risks are in place

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-61434?

PraisonAI's command-execution guardrail filters shell metacharacters but fails to account for find's built-in -exec, -execdir, and -delete actions, letting an attacker run arbitrary binaries, read blocked files, or delete data without ever triggering the blocklist. The CVSS 8.8 score reflects the full compromise potential — confidentiality, integrity, and availability all rated high — and the attack requires only low privileges, no user interaction, and low complexity, making it trivially reachable by anyone who can get PraisonAI's agent to execute a crafted find command. There is no EPSS data, no known public exploit, and it is not in CISA KEV, so this is not yet under active exploitation, but the technique is well-documented (GitHub Security Advisory GHSA-cv3g-hj65-pcfh, VulnCheck advisory) and trivially reproducible once known. Any deployment where PraisonAI executes LLM-generated or user-supplied shell commands against an allowlist should treat this as a priority patch. Upgrade to PraisonAI 4.6.78 or later immediately, and in the interim audit logs for find invocations containing -exec, -execdir, or -delete flags.

Is CVE-2026-61434 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-61434, increasing the risk of exploitation.

How to fix CVE-2026-61434?

Upgrade PraisonAI to version 4.6.78 or later immediately, where the allowlist logic accounts for find's built-in actions. If immediate patching isn't possible, disable or heavily restrict the shell/command-execution tool for agents that accept untrusted input, and explicitly strip or reject find invocations containing -exec, -execdir, -delete, -fprintf, or similar built-in actions at the tool-invocation layer rather than relying solely on shell metacharacter filtering. Run agent shell tools inside a sandboxed, least-privilege environment (container, restricted user, read-only filesystem where possible) so that even a successful allowlist bypass cannot reach sensitive files or binaries. For detection, monitor agent tool-invocation logs for find commands containing these flags, and alert on any unexpected file deletions or executions originating from the agent runtime.

What systems are affected by CVE-2026-61434?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks.

What is the CVSS score for CVE-2026-61434?

CVE-2026-61434 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.73%.

What is the AI security impact?

Affected AI Architectures

agent frameworks

MITRE ATLAS Techniques

AML.T0050Command and Scripting Interpreter

AML.T0053AI Agent Tool Invocation

AML.T0101Data Destruction via AI Agent Tool Invocation

AML.T0102Generate Malicious Commands

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell command execution that allows attackers to execute restricted commands via find's built-in -exec, -execdir, and -delete actions. Attackers can craft find commands with these built-in actions to read blocked files, delete files, or execute non-allowlisted binaries without triggering shell metacharacter filters.

Exploitation Scenario

An attacker interacting with a PraisonAI-powered agent — either directly as a low-privileged user or indirectly via a prompt-injected document the agent processes — steers the agent to execute a find command such as `find / -name secrets.env -exec cat {} \;` or one using -delete against critical files. Because the allowlist filter only inspects for shell metacharacters (pipes, semicolons, backticks) and not find's own built-in execution primitives, the command passes validation and executes with the agent's privileges. The attacker now has read access to blocked files (credentials, API keys, model configs), can delete artifacts to sabotage the pipeline, or chain -exec to run a non-allowlisted binary, achieving code execution beyond what the allowlist was designed to permit — all without any error or filter trigger visible to defenders.

Weaknesses (CWE)

CWE-693Protection Mechanism FailurePrimary CWE-78Improper Neutralization of Special Elements used in an OS CommandPrimary CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Primary CWE-78Improper Neutralization of Special Elements used in an OS Command

CWE-693 — Protection Mechanism Failure: The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Source: MITRE CWE corpus.