CVE-2026-61446: PraisonAI RCE — HIGH

CISO Take

PraisonAI's plugin manager imports and executes any .py file it finds in a project's or user's .praisonai/plugins/ directory, with no code signing, hash verification, or sandboxing to confirm the code is trusted before running it. For CISOs, the concern isn't internet-facing exposure — this is a local, low-complexity vector (CVSS 8.4, AV:L/PR:N/UI:N) — it's that PraisonAI is an agent framework often wired into automated pipelines, CI jobs, or shared dev environments, where a path-traversal write, a poisoned dependency, or a compromised teammate repo can drop a plugin file that executes with the full privileges of whatever process initializes the agent. There is no EPSS score yet, it isn't in CISA KEV, and no public exploit or Nuclei template exists, so this reads as unweaponized rather than under active attack — but the package's history of 138 other CVEs and a package risk score of 0/100 point to weak baseline security hygiene in this dependency. Upgrade praisonai/praisonaiagents to 1.6.78 or later immediately, and until then treat any writable .praisonai/plugins/ path (project or $HOME) as an untrusted code-execution surface — lock down write permissions and audit existing plugin directories for unexpected .py files.

Sources: NVD GitHub Advisory vulncheck.com ATLAS

What is the risk?

High severity (CVSS 8.4) despite a local-only attack vector: PR:N and UI:N mean any actor capable of writing a file to the plugin directory achieves full confidentiality/integrity/availability compromise with no further interaction, and low attack complexity flattens the bar to exploitation. Exploitability today is unconfirmed — no EPSS percentile, no CISA KEV listing, no public PoC or Nuclei template — but the underlying primitive (unsandboxed importlib exec_module on developer-writable paths) is a well-understood RCE pattern, so realistic risk should be treated as elevated even absent in-the-wild evidence. The package's track record of 138 other CVEs and a package risk score of 0/100 further suggest a project with weak baseline security hygiene, raising the odds of chained or repeat exploitation.

How does the attack unfold?

Initial Access

Attacker writes a malicious .py file into the project-level or user-home .praisonai/plugins/ directory via path traversal, a compromised dependency, or a supply-chain-compromised repo.

AML.T0010.005

Execution

PraisonAI's plugin manager auto-discovers the file and loads it using importlib spec_from_file_location()/exec_module() with no signing or integrity check.

AML.T0050

Impact

Attacker code runs with the full privileges of the agent process, enabling credential theft, lateral movement to connected tools, or persistence on the host.

Initial Access

Attacker writes a malicious .py file into the project-level or user-home .praisonai/plugins/ directory via path traversal, a compromised dependency, or a supply-chain-compromised repo.

AML.T0010.005

Execution

PraisonAI's plugin manager auto-discovers the file and loads it using importlib spec_from_file_location()/exec_module() with no signing or integrity check.

AML.T0050

Impact

Attacker code runs with the full privileges of the agent process, enabling credential theft, lateral movement to connected tools, or persistence on the host.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents 69% patched ~13d to patch Full package profile →
PraisonAI	pip	—	No patch
1 dependents 69% patched ~13d to patch Full package profile →

How severe is it?

CVSS 3.1

8.4 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 25% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Local

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Upgrade praisonaiagents/praisonai to 1.6.78 or later, where the fix is tracked under GHSA-m6wp-h223-4c8g. Until patched, restrict write access to both project-level and user-home .praisonai/plugins/ directories to trusted principals only, and treat any third-party PraisonAI plugin as untrusted code requiring manual review before installation. For detection, monitor for unexpected .py file creation under .praisonai/plugins/ paths and audit process-execution logs for python child processes spawned shortly after PraisonAI agent initialization. Longer term, push the vendor toward signed or hash-pinned plugins loaded in a restricted subprocess/sandbox rather than in-process via exec_module.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Code Execution Agent Plugin AML.T0010.005 - AI Agent Tool AML.T0011.001 - Malicious Package AML.T0050 - Command and Scripting Interpreter AML.T0081 - Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2 - Third-party and supplier management for AI systems

NIST AI RMF

GOVERN-6.1 - Policies and procedures for third-party AI system components

OWASP LLM Top 10

LLM03:2025 - Supply Chain LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-61446?

PraisonAI's plugin manager imports and executes any .py file it finds in a project's or user's .praisonai/plugins/ directory, with no code signing, hash verification, or sandboxing to confirm the code is trusted before running it. For CISOs, the concern isn't internet-facing exposure — this is a local, low-complexity vector (CVSS 8.4, AV:L/PR:N/UI:N) — it's that PraisonAI is an agent framework often wired into automated pipelines, CI jobs, or shared dev environments, where a path-traversal write, a poisoned dependency, or a compromised teammate repo can drop a plugin file that executes with the full privileges of whatever process initializes the agent. There is no EPSS score yet, it isn't in CISA KEV, and no public exploit or Nuclei template exists, so this reads as unweaponized rather than under active attack — but the package's history of 138 other CVEs and a package risk score of 0/100 point to weak baseline security hygiene in this dependency. Upgrade praisonai/praisonaiagents to 1.6.78 or later immediately, and until then treat any writable .praisonai/plugins/ path (project or $HOME) as an untrusted code-execution surface — lock down write permissions and audit existing plugin directories for unexpected .py files.

Is CVE-2026-61446 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-61446, increasing the risk of exploitation.

How to fix CVE-2026-61446?

Upgrade praisonaiagents/praisonai to 1.6.78 or later, where the fix is tracked under GHSA-m6wp-h223-4c8g. Until patched, restrict write access to both project-level and user-home .praisonai/plugins/ directories to trusted principals only, and treat any third-party PraisonAI plugin as untrusted code requiring manual review before installation. For detection, monitor for unexpected .py file creation under .praisonai/plugins/ paths and audit process-execution logs for python child processes spawned shortly after PraisonAI agent initialization. Longer term, push the vendor toward signed or hash-pinned plugins loaded in a restricted subprocess/sandbox rather than in-process via exec_module.

What systems are affected by CVE-2026-61446?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, plugin/tool integration pipelines.

What is the CVSS score for CVE-2026-61446?

CVE-2026-61446 has a CVSS v3.1 base score of 8.4 (HIGH). The EPSS exploitation probability is 0.33%.

What is the AI security impact?

Affected AI Architectures

agent frameworksplugin/tool integration pipelines

MITRE ATLAS Techniques

AML.T0010.005 AI Agent Tool

AML.T0011.001 Malicious Package

AML.T0050 Command and Scripting Interpreter

AML.T0081 Modify AI Agent Configuration

Compliance Controls Affected

ISO 42001: A.6.2

NIST AI RMF: GOVERN-6.1

OWASP LLM Top 10: LLM03:2025, LLM06:2025

What are the technical details?

Original Advisory

PraisonAI (praisonaiagents) before 1.6.78 contains a remote code execution vulnerability in the plugin manager, which loads and executes arbitrary Python (.py) files from project-level and user-home .praisonai/plugins/ directories using importlib spec_from_file_location() and exec_module() without code signing, integrity verification, or sandboxing. An attacker who can write a malicious .py file to a plugin directory (for example via path traversal, a supply chain attack, or a compromised dependency) achieves arbitrary code execution when the plugin system initializes.

Exploitation Scenario

An attacker compromises a dependency listed in a project's requirements, or exploits a path-traversal bug elsewhere in the application, to write a file such as .praisonai/plugins/update_helper.py into the target project or the invoking user's home directory. No user interaction or elevated privileges are needed — the next time the PraisonAI agent initializes, its plugin manager auto-discovers the file via importlib.util.spec_from_file_location() and calls exec_module(), running the attacker's code with the full privileges of the agent process, e.g. harvesting API keys/credentials the agent holds, pivoting to connected tools, or establishing host persistence.

Weaknesses (CWE)

CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.