CVE-2026-61443: PraisonAI path traversal leads to RCE

CISO Take

PraisonAI's SkillTools.run_skill_script() executes scripts without validating that the target path stays inside the intended working directory, so a low-privileged caller can pass an absolute path and have the agent execute an arbitrary script from anywhere on the filesystem. This is a network-exploitable, low-complexity flaw (CVSS 8.1, AV:N/AC:L/PR:L/UI:N) with high confidentiality and integrity impact, meaning any deployment that exposes agent skill invocation to less-trusted callers or LLM-driven tool calls is directly exposed to remote code execution. There is no EPSS score, no CISA KEV listing, no public exploit code, and no Nuclei template yet, and package telemetry shows only 1 known downstream dependent — so real-world exploitation pressure currently looks low, but the primitive itself (unsanitized path into script execution) is trivial to weaponize once a PoC surfaces. Patch to PraisonAI 1.6.78 or later; until then, restrict or sandbox any code path that lets user- or model-supplied input reach run_skill_script(), and add outbound path allowlisting in front of it. Detection teams should hunt for skill-tool invocations that reference paths outside the agent's configured working directory or standard skill library location.

Sources: NVD GitHub Advisory vulncheck.com ATLAS

What is the risk?

The vulnerability is straightforward to exploit technically (network vector, low attack complexity, no user interaction) and grants high confidentiality and integrity impact, which would normally push urgency high. However, real-world exploitation signals are currently absent: no EPSS score is available, the CVE is not in CISA KEV, there is no public exploit or Nuclei scanner coverage, and the package has only 1 tracked downstream dependent, limiting blast radius relative to widely-embedded frameworks. Net assessment: high technical severity, currently low observed exploitation likelihood — but the low privilege requirement (PR:L) means any environment that grants API/tool access to semi-trusted users, plugins, or LLM-constructed tool calls should treat this as urgent to patch rather than defer.

How does the attack unfold?

Initial Access

Attacker reaches a network-exposed application or API that invokes PraisonAI's agent skill execution with low required privileges.

AML.T0049

Tool Invocation

Attacker supplies or influences a skill_script parameter containing an absolute path, invoking SkillTools.run_skill_script() as an agent tool call.

AML.T0053

Execution

Lacking path containment validation, PraisonAI executes the attacker-chosen script located outside the intended working directory.

AML.T0050

Impact

The attacker achieves code execution in the agent process, enabling credential theft, data exposure, or full compromise of the host running the agent.

AML.T0112.000

Initial Access

Attacker reaches a network-exposed application or API that invokes PraisonAI's agent skill execution with low required privileges.

AML.T0049

Tool Invocation

Attacker supplies or influences a skill_script parameter containing an absolute path, invoking SkillTools.run_skill_script() as an agent tool call.

AML.T0053

Execution

Lacking path containment validation, PraisonAI executes the attacker-chosen script located outside the intended working directory.

AML.T0050

Impact

The attacker achieves code execution in the agent process, enabling credential theft, data exposure, or full compromise of the host running the agent.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents 69% patched ~13d to patch Full package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.8%

chance of exploitation in 30 days

Higher than 53% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A None

What should I do?

1 step

Upgrade PraisonAI to 1.6.78 or later immediately. Where upgrading isn't immediately possible, add an explicit allowlist/containment check in front of any call to SkillTools.run_skill_script() that rejects absolute paths or paths resolving outside the configured skill directory (canonicalize and verify with os.path.realpath + prefix check). Run agent skill execution inside a container, chroot, or restricted service account with least-privilege filesystem access so that even a successful path escape has limited reach. Audit any code that constructs skill_script arguments from user input, API parameters, or LLM tool-call outputs, and treat those as untrusted input requiring validation. For detection, log and alert on skill-script executions referencing paths outside the expected working directory or known skill library locations.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Data Leakage Agent Plugin AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system security

NIST AI RMF

MEASURE 2.7 - AI system security and resilience is evaluated and documented

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-61443?

PraisonAI's SkillTools.run_skill_script() executes scripts without validating that the target path stays inside the intended working directory, so a low-privileged caller can pass an absolute path and have the agent execute an arbitrary script from anywhere on the filesystem. This is a network-exploitable, low-complexity flaw (CVSS 8.1, AV:N/AC:L/PR:L/UI:N) with high confidentiality and integrity impact, meaning any deployment that exposes agent skill invocation to less-trusted callers or LLM-driven tool calls is directly exposed to remote code execution. There is no EPSS score, no CISA KEV listing, no public exploit code, and no Nuclei template yet, and package telemetry shows only 1 known downstream dependent — so real-world exploitation pressure currently looks low, but the primitive itself (unsanitized path into script execution) is trivial to weaponize once a PoC surfaces. Patch to PraisonAI 1.6.78 or later; until then, restrict or sandbox any code path that lets user- or model-supplied input reach run_skill_script(), and add outbound path allowlisting in front of it. Detection teams should hunt for skill-tool invocations that reference paths outside the agent's configured working directory or standard skill library location.

Is CVE-2026-61443 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-61443, increasing the risk of exploitation.

How to fix CVE-2026-61443?

Upgrade PraisonAI to 1.6.78 or later immediately. Where upgrading isn't immediately possible, add an explicit allowlist/containment check in front of any call to SkillTools.run_skill_script() that rejects absolute paths or paths resolving outside the configured skill directory (canonicalize and verify with os.path.realpath + prefix check). Run agent skill execution inside a container, chroot, or restricted service account with least-privilege filesystem access so that even a successful path escape has limited reach. Audit any code that constructs skill_script arguments from user input, API parameters, or LLM tool-call outputs, and treat those as untrusted input requiring validation. For detection, log and alert on skill-script executions referencing paths outside the expected working directory or known skill library locations.

What systems are affected by CVE-2026-61443?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent tool/skill invocation pipelines.

What is the CVSS score for CVE-2026-61443?

CVE-2026-61443 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.77%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent tool/skill invocation pipelines

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

PraisonAI before 1.6.78 contains a remote code execution vulnerability in SkillTools.run_skill_script() that executes scripts without path containment validation. Attackers can supply absolute file paths to execute arbitrary scripts from any filesystem location, including those outside the intended working directory.

Exploitation Scenario

An attacker with low-privilege access to a PraisonAI-based agent's tool/skill interface — whether a direct API caller or an actor able to influence the parameters an LLM passes into a tool call — supplies an absolute path (e.g., pointing to a script the attacker has staged in a predictable writable location, or a sensitive system script) as the skill_script argument to run_skill_script(). Because the function performs no path containment validation, PraisonAI executes that script in the context of the agent process rather than restricting execution to the intended skills directory. The attacker gains code execution, which can be used to read local files and credentials, pivot to other services the agent process can reach, or manipulate subsequent agent behavior.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.