CVE-2026-61444: PraisonAI code injection

CISO Take

PraisonAI's deploy/api.py builds Python server code by interpolating the agents_file parameter directly into an f-string, and that generated code is then executed via subprocess.Popen() — a textbook code injection (CWE-94) with a 9.1 critical CVSS score and full confidentiality, integrity, and availability impact. There's no EPSS data and no public exploit or scanner template yet, so this hasn't been weaponized in the wild, but the vector is network-reachable with low attack complexity and no user interaction, meaning any account with high privileges on the deploy endpoint can pivot straight to arbitrary code execution on the host running the agent server. Because PraisonAI is an agent orchestration framework, a compromised deploy endpoint doesn't just give an attacker a shell — it gives them a foothold inside whatever the agent's tools, credentials, and downstream integrations can reach. There's no CISA KEV listing and no SSVC decision, so treat this as high-priority patch-now rather than drop-everything, but don't wait for exploitation telemetry given the CVSS. Upgrade to PraisonAI 4.6.78 or later immediately, and in the interim restrict who can call the deploy API and audit agents_file inputs for anomalous string content.

Sources: NVD GitHub Advisory ATLAS vulncheck.com

What is the risk?

Critical on paper (CVSS 9.1) but tempered by two factors: privileges required is High (PR:H), meaning an attacker needs an already-privileged account or session on the PraisonAI deploy surface before they can inject code, and there is no evidence yet of a public exploit, Nuclei template, or EPSS/KEV signal indicating active exploitation. That said, attack complexity is low and no user interaction is needed once access exists, and the scope is changed (S:C), meaning a successful exploit can affect resources beyond the vulnerable component itself — likely the full host process and anything it can reach (files, network, credentials, connected tools). For any organization running PraisonAI-based agent deployments with multi-tenant or delegated access to the deploy API, this should be treated as an urgent patch, not a background item.

How does the attack unfold?

Initial Access

Attacker with high-privilege access to the PraisonAI deploy API submits a crafted agents_file parameter.

AML.T0049

Code Injection

The unsanitized agents_file value is interpolated directly into an f-string used to generate Python server code, allowing the attacker's payload to escape the intended string context.

AML.T0050

Execution

The generated code, now containing the injected payload, is executed via subprocess.Popen() with the privileges of the deploy process.

AML.T0103

Impact

Attacker achieves arbitrary code execution on the host, enabling credential theft, lateral movement to connected agent tools/data, or persistence.

Initial Access

Attacker with high-privilege access to the PraisonAI deploy API submits a crafted agents_file parameter.

AML.T0049

Code Injection

The unsanitized agents_file value is interpolated directly into an f-string used to generate Python server code, allowing the attacker's payload to escape the intended string context.

AML.T0050

Execution

The generated code, now containing the injected payload, is executed via subprocess.Popen() with the privileges of the deploy process.

AML.T0103

Impact

Attacker achieves arbitrary code execution on the host, enabling credential theft, lateral movement to connected agent tools/data, or persistence.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents 66% patched ~14d to patch Full package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

9.1 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 33% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR High

UI None

S Changed

C High

I High

A High

What should I do?

1 step

1) Upgrade PraisonAI to version 4.6.78 or later immediately — this is the fix version per the GitHub Security Advisory GHSA-g6j7-pffp-8whg. 2) Until patched, restrict access to the deploy API to trusted, minimal-privilege operators only, since exploitation requires high privileges (PR:H) — tightening authorization on this endpoint meaningfully reduces exposure. 3) Audit any agents_file inputs submitted historically for anomalous characters (unescaped quotes, braces, or Python syntax fragments) that could indicate attempted or successful injection. 4) Monitor subprocess/process-creation activity on hosts running PraisonAI deploy services (EDR/auditd process trees spawned from the deploy component) for unexpected child processes or outbound connections. 5) Where feasible, run PraisonAI deploy services in a sandboxed/isolated environment (container with reduced privileges, no direct network egress) to limit blast radius pending patch rollout.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Agent Framework API AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0103 - Deploy AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

Clause 8.1 - Operational planning and control

NIST AI RMF

MANAGE-4.1 - Risks stemming from third-party AI resources are managed

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-61444?

PraisonAI's deploy/api.py builds Python server code by interpolating the agents_file parameter directly into an f-string, and that generated code is then executed via subprocess.Popen() — a textbook code injection (CWE-94) with a 9.1 critical CVSS score and full confidentiality, integrity, and availability impact. There's no EPSS data and no public exploit or scanner template yet, so this hasn't been weaponized in the wild, but the vector is network-reachable with low attack complexity and no user interaction, meaning any account with high privileges on the deploy endpoint can pivot straight to arbitrary code execution on the host running the agent server. Because PraisonAI is an agent orchestration framework, a compromised deploy endpoint doesn't just give an attacker a shell — it gives them a foothold inside whatever the agent's tools, credentials, and downstream integrations can reach. There's no CISA KEV listing and no SSVC decision, so treat this as high-priority patch-now rather than drop-everything, but don't wait for exploitation telemetry given the CVSS. Upgrade to PraisonAI 4.6.78 or later immediately, and in the interim restrict who can call the deploy API and audit agents_file inputs for anomalous string content.

Is CVE-2026-61444 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-61444, increasing the risk of exploitation.

How to fix CVE-2026-61444?

1) Upgrade PraisonAI to version 4.6.78 or later immediately — this is the fix version per the GitHub Security Advisory GHSA-g6j7-pffp-8whg. 2) Until patched, restrict access to the deploy API to trusted, minimal-privilege operators only, since exploitation requires high privileges (PR:H) — tightening authorization on this endpoint meaningfully reduces exposure. 3) Audit any agents_file inputs submitted historically for anomalous characters (unescaped quotes, braces, or Python syntax fragments) that could indicate attempted or successful injection. 4) Monitor subprocess/process-creation activity on hosts running PraisonAI deploy services (EDR/auditd process trees spawned from the deploy component) for unexpected child processes or outbound connections. 5) Where feasible, run PraisonAI deploy services in a sandboxed/isolated environment (container with reduced privileges, no direct network egress) to limit blast radius pending patch rollout.

What systems are affected by CVE-2026-61444?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, agent deployment/serving pipelines.

What is the CVSS score for CVE-2026-61444?

CVE-2026-61444 has a CVSS v3.1 base score of 9.1 (CRITICAL). The EPSS exploitation probability is 0.39%.

What is the AI security impact?

Affected AI Architectures

agent frameworksagent deployment/serving pipelines

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0103 Deploy AI Agent

Compliance Controls Affected

ISO 42001: Clause 8.1

NIST AI RMF: MANAGE-4.1

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

PraisonAI versions before 4.6.78 contain a code injection vulnerability in deploy/api.py where the agents_file parameter is directly interpolated into an f-string without sanitization. Attackers can inject arbitrary Python code that executes when the generated server code runs via subprocess.Popen().

Exploitation Scenario

An attacker who holds a high-privilege account on a platform exposing PraisonAI's deploy API submits an agent configuration via the agents_file parameter, crafting its value to break out of the f-string context (e.g., closing braces/quotes to inject arbitrary Python expressions or statements). The deploy endpoint interpolates this value directly into the generated server code without sanitization, embedding the attacker's payload into the Python source that will run the agent's HTTP server. When that generated code executes via subprocess.Popen(), the injected payload runs with the privileges of the deploy process — giving the attacker arbitrary command execution on the host, from which they can exfiltrate agent credentials, pivot to connected tools/data sources, or establish persistence.

Weaknesses (CWE)

CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.