CVE-2026-61446: PraisonAI RCE — HIGH

Q: Is CVE-2026-61446 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-61446, increasing the risk of exploitation.

Q: How to fix CVE-2026-61446?

Upgrade praisonaiagents/praisonai to 1.6.78 or later, where the fix is tracked under GHSA-m6wp-h223-4c8g. Until patched, restrict write access to both project-level and user-home .praisonai/plugins/ directories to trusted principals only, and treat any third-party PraisonAI plugin as untrusted code requiring manual review before installation. For detection, monitor for unexpected .py file creation under .praisonai/plugins/ paths and audit process-execution logs for python child processes spawned shortly after PraisonAI agent initialization. Longer term, push the vendor toward signed or hash-pinned plugins loaded in a restricted subprocess/sandbox rather than in-process via exec_module.

Q: What systems are affected by CVE-2026-61446?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, plugin/tool integration pipelines.

Q: What is the CVSS score for CVE-2026-61446?

CVE-2026-61446 has a CVSS v3.1 base score of 8.4 (HIGH). The EPSS exploitation probability is 0.34%.

CISO Take

PraisonAI's plugin manager imports and executes any .py file it finds in a project's or user's .praisonai/plugins/ directory, with no code signing, hash verification, or sandboxing to confirm the code is trusted before running it. For CISOs, the concern isn't internet-facing exposure — this is a local, low-complexity vector (CVSS 8.4, AV:L/PR:N/UI:N) — it's that PraisonAI is an agent framework often wired into automated pipelines, CI jobs, or shared dev environments, where a path-traversal write, a poisoned dependency, or a compromised teammate repo can drop a plugin file that executes with the full privileges of whatever process initializes the agent. There is no EPSS score yet, it isn't in CISA KEV, and no public exploit or Nuclei template exists, so this reads as unweaponized rather than under active attack — but the package's history of 138 other CVEs and a package risk score of 0/100 point to weak baseline security hygiene in this dependency. Upgrade praisonai/praisonaiagents to 1.6.78 or later immediately, and until then treat any writable .praisonai/plugins/ path (project or $HOME) as an untrusted code-execution surface — lock down write permissions and audit existing plugin directories for unexpected .py files.

Sources:NVDGitHub Advisoryvulncheck.comATLAS

What is the risk?

High severity (CVSS 8.4) despite a local-only attack vector: PR:N and UI:N mean any actor capable of writing a file to the plugin directory achieves full confidentiality/integrity/availability compromise with no further interaction, and low attack complexity flattens the bar to exploitation. Exploitability today is unconfirmed — no EPSS percentile, no CISA KEV listing, no public PoC or Nuclei template — but the underlying primitive (unsandboxed importlib exec_module on developer-writable paths) is a well-understood RCE pattern, so realistic risk should be treated as elevated even absent in-the-wild evidence. The package's track record of 138 other CVEs and a package risk score of 0/100 further suggest a project with weak baseline security hygiene, raising the odds of chained or repeat exploitation.

How does the attack unfold?

Initial Access

Attacker writes a malicious .py file into the project-level or user-home .praisonai/plugins/ directory via path traversal, a compromised dependency, or a supply-chain-compromised repo.

AML.T0010.005

Execution

PraisonAI's plugin manager auto-discovers the file and loads it using importlib spec_from_file_location()/exec_module() with no signing or integrity check.

AML.T0050

Impact

Attacker code runs with the full privileges of the agent process, enabling credential theft, lateral movement to connected tools, or persistence on the host.

Initial Access

Attacker writes a malicious .py file into the project-level or user-home .praisonai/plugins/ directory via path traversal, a compromised dependency, or a supply-chain-compromised repo.

AML.T0010.005

Execution

PraisonAI's plugin manager auto-discovers the file and loads it using importlib spec_from_file_location()/exec_module() with no signing or integrity check.

AML.T0050

Impact

Attacker code runs with the full privileges of the agent process, enabling credential theft, lateral movement to connected tools, or persistence on the host.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents61% patched~23d to patchFull package profile →
PraisonAI	pip	—	No patch
1 dependents61% patched~23d to patchFull package profile →
PraisonAI Agents	pip	<= 1.6.77	`1.6.78`
20 dependents63% patched~21d to patchFull package profile →

How severe is it?

CVSS 3.1

8.4 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 27% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVLocal

ACLow

PRNone

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

Upgrade praisonaiagents/praisonai to 1.6.78 or later, where the fix is tracked under GHSA-m6wp-h223-4c8g. Until patched, restrict write access to both project-level and user-home .praisonai/plugins/ directories to trusted principals only, and treat any third-party PraisonAI plugin as untrusted code requiring manual review before installation. For detection, monitor for unexpected .py file creation under .praisonai/plugins/ paths and audit process-execution logs for python child processes spawned shortly after PraisonAI agent initialization. Longer term, push the vendor toward signed or hash-pinned plugins loaded in a restricted subprocess/sandbox rather than in-process via exec_module.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply ChainCode ExecutionAgentPluginAML.T0010.005- AI Agent Tool AML.T0011.001- Malicious Package AML.T0050- Command and Scripting Interpreter AML.T0081- Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2-Third-party and supplier management for AI systems

NIST AI RMF

GOVERN-6.1-Policies and procedures for third-party AI system components

OWASP LLM Top 10

LLM03:2025-Supply ChainLLM06:2025-Excessive Agency

Frequently Asked Questions

What is CVE-2026-61446?

PraisonAI's plugin manager imports and executes any .py file it finds in a project's or user's .praisonai/plugins/ directory, with no code signing, hash verification, or sandboxing to confirm the code is trusted before running it. For CISOs, the concern isn't internet-facing exposure — this is a local, low-complexity vector (CVSS 8.4, AV:L/PR:N/UI:N) — it's that PraisonAI is an agent framework often wired into automated pipelines, CI jobs, or shared dev environments, where a path-traversal write, a poisoned dependency, or a compromised teammate repo can drop a plugin file that executes with the full privileges of whatever process initializes the agent. There is no EPSS score yet, it isn't in CISA KEV, and no public exploit or Nuclei template exists, so this reads as unweaponized rather than under active attack — but the package's history of 138 other CVEs and a package risk score of 0/100 point to weak baseline security hygiene in this dependency. Upgrade praisonai/praisonaiagents to 1.6.78 or later immediately, and until then treat any writable .praisonai/plugins/ path (project or $HOME) as an untrusted code-execution surface — lock down write permissions and audit existing plugin directories for unexpected .py files.

Is CVE-2026-61446 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-61446, increasing the risk of exploitation.

How to fix CVE-2026-61446?

Upgrade praisonaiagents/praisonai to 1.6.78 or later, where the fix is tracked under GHSA-m6wp-h223-4c8g. Until patched, restrict write access to both project-level and user-home .praisonai/plugins/ directories to trusted principals only, and treat any third-party PraisonAI plugin as untrusted code requiring manual review before installation. For detection, monitor for unexpected .py file creation under .praisonai/plugins/ paths and audit process-execution logs for python child processes spawned shortly after PraisonAI agent initialization. Longer term, push the vendor toward signed or hash-pinned plugins loaded in a restricted subprocess/sandbox rather than in-process via exec_module.

What systems are affected by CVE-2026-61446?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, plugin/tool integration pipelines.

What is the CVSS score for CVE-2026-61446?

CVE-2026-61446 has a CVSS v3.1 base score of 8.4 (HIGH). The EPSS exploitation probability is 0.34%.

What is the AI security impact?

Affected AI Architectures

agent frameworksplugin/tool integration pipelines

MITRE ATLAS Techniques

AML.T0010.005AI Agent Tool

AML.T0011.001Malicious Package

AML.T0050Command and Scripting Interpreter

AML.T0081Modify AI Agent Configuration

Compliance Controls Affected

ISO 42001: A.6.2

NIST AI RMF: GOVERN-6.1

OWASP LLM Top 10: LLM03:2025, LLM06:2025

What are the technical details?

Original Advisory

PraisonAI (praisonaiagents) before 1.6.78 contains a remote code execution vulnerability in the plugin manager, which loads and executes arbitrary Python (.py) files from project-level and user-home .praisonai/plugins/ directories using importlib spec_from_file_location() and exec_module() without code signing, integrity verification, or sandboxing. An attacker who can write a malicious .py file to a plugin directory (for example via path traversal, a supply chain attack, or a compromised dependency) achieves arbitrary code execution when the plugin system initializes.

Exploitation Scenario

An attacker compromises a dependency listed in a project's requirements, or exploits a path-traversal bug elsewhere in the application, to write a file such as .praisonai/plugins/update_helper.py into the target project or the invoking user's home directory. No user interaction or elevated privileges are needed — the next time the PraisonAI agent initializes, its plugin manager auto-discovers the file via importlib.util.spec_from_file_location() and calls exec_module(), running the attacker's code with the full privileges of the agent process, e.g. harvesting API keys/credentials the agent holds, pivoting to connected tools, or establishing host persistence.

Weaknesses (CWE)

CWE-427Uncontrolled Search Path ElementPrimary CWE-94Improper Control of Generation of Code ('Code Injection')Primary CWE-94Improper Control of Generation of Code ('Code Injection')Primary CWE-94Improper Control of Generation of Code ('Code Injection')

CWE-427 — Uncontrolled Search Path Element: The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

[Architecture and Design, Implementation] Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
[Implementation] When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.

Source: MITRE CWE corpus.