CVE-2026-62176: PraisonAI: code injection in deploy API enables RCE

GHSA-g6j7-pffp-8whgCRITICALPoC AVAILABLECISA: ATTEND

Published October 7, 2026

CISO Take

PraisonAI, a multi-agent orchestration framework, has a code injection flaw (CVE-2026-62176) in `deploy/api.py`. The `agents_file` parameter is interpolated directly into an f-string, written to a Python file and run with `subprocess.Popen()`, so whoever controls that value runs arbitrary code on the host. It scores CVSS 9.1 (critical), but exploitation requires high privileges (PR:H). In practice that means access to the CLI, the configuration or an upstream API that feeds the parameter. No public exploit, Nuclei template or KEV listing exists, and there is no EPSS data, so there is no evidence of active exploitation today. Blast radius is limited by only 1 downstream dependent, but the package has 164 other CVEs, which points to a weak security posture overall. Upgrade to 4.6.78 or later, and until then don't let untrusted sources reach the deployment command or any wrapper that builds `agents_file`.

Sources:NVDGitHub AdvisoryATLASOpenSSF

What is the risk?

Medium-high in practice, critical on paper (CVSS 9.1). Network vector, low complexity and no user interaction, but it needs high privileges, which cuts exposure to environments where the deployment parameter is reachable by semi-trusted users, automation pipelines or upstream APIs. Scope is Changed (S:C), so a compromise can spread beyond the vulnerable component. There is no public exploit, no KEV listing, no EPSS data and no SSVC decision. The package's history (164 other CVEs) and its 0/100 risk score argue for caution. Exploitation is trivial once the input is controlled, because it is a plain f-string injection.

How does the attack unfold?

Initial Access

The attacker gains control of the `agents_file` value through the CLI, configuration or an upstream API with high privileges.

AML.T0049

Code Injection

A crafted value breaks out of the f-string and adds arbitrary Python to the generated server file.

AML.T0050

Execution

`subprocess.Popen()` runs the generated file, so the injected code runs on the host with the process privileges.

AML.T0050

Impact

The attacker steals LLM and tool credentials, accesses internal data and moves laterally through systems connected to the agent.

AML.T0083

Initial Access

The attacker gains control of the `agents_file` value through the CLI, configuration or an upstream API with high privileges.

AML.T0049

Code Injection

A crafted value breaks out of the f-string and adds arbitrary Python to the generated server file.

AML.T0050

Execution

`subprocess.Popen()` runs the generated file, so the injected code runs on the host with the process privileges.

AML.T0050

Impact

The attacker steals LLM and tool credentials, accesses internal data and moves laterally through systems connected to the agent.

AML.T0083

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	<= 4.6.77	`4.6.78`
1 dependents61% patched~23d to patchFull package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

9.1 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 40% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRHigh

UINone

SChanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade praisonai to >= 4.6.78. 2) Until patched, block untrusted input from reaching agents_file in the CLI, configuration files and any API or wrapper that invokes deploy; accept only fixed paths from an allowlist. 3) Limit who can run deployment commands and edit agent configuration (least privilege). 4) Run the deploy process in a container or sandbox with minimal credentials and restricted egress. 5) Detection: audit generated server files and child processes spawned by subprocess.Popen from the PraisonAI deploy; look for unexpected Python code, quotes or special characters in agents_file values; review logs for deployments with unusual paths. 6) Rotate LLM and tool API keys if suspicious activity is found. 7) Inventory every PraisonAI use with pip list and SBOM scans.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionSupply ChainFrameworkAgentAPIAML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter AML.T0083- Credentials from AI Agent Configuration AML.T0112.000- Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks and mechanisms to supersede or deactivate AI systems

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-62176?

Is CVE-2026-62176 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-62176, increasing the risk of exploitation.

How to fix CVE-2026-62176?

1) Upgrade praisonai to >= 4.6.78. 2) Until patched, block untrusted input from reaching `agents_file` in the CLI, configuration files and any API or wrapper that invokes deploy; accept only fixed paths from an allowlist. 3) Limit who can run deployment commands and edit agent configuration (least privilege). 4) Run the deploy process in a container or sandbox with minimal credentials and restricted egress. 5) Detection: audit generated server files and child processes spawned by `subprocess.Popen` from the PraisonAI deploy; look for unexpected Python code, quotes or special characters in `agents_file` values; review logs for deployments with unusual paths. 6) Rotate LLM and tool API keys if suspicious activity is found. 7) Inventory every PraisonAI use with `pip list` and SBOM scans.

What systems are affected by CVE-2026-62176?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, Multi-agent orchestration, Agent deployment and serving APIs, CI/CD pipelines for AI agents.

What is the CVSS score for CVE-2026-62176?

CVE-2026-62176 has a CVSS v3.1 base score of 9.1 (CRITICAL). The EPSS exploitation probability is 0.46%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksMulti-agent orchestrationAgent deployment and serving APIsCI/CD pipelines for AI agents

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

AML.T0083Credentials from AI Agent Configuration

AML.T0112.000Local AI Agent

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. Prior to version 4.6.78, the `deploy/api.py` module generates Python server code by directly interpolating the `agents_file` parameter into an f-string that is then written to a file and executed via `subprocess.Popen()`. An attacker who controls the `agents_file` value (via CLI argument, configuration, or upstream API) can inject arbitrary Python code. Version 4.6.78 patches the issue.

Exploitation Scenario

An attacker gets privileged access to a platform that lets teams deploy PraisonAI agents, for example a compromised internal account, a pipeline that takes the agents file name from a configuration repository, or an upstream API with weak validation. They supply an `agents_file` value containing a closing quote and Python statements, for example one that opens a reverse shell or reads environment variables. The deploy module writes it into the generated server file and `Popen` runs it. The attacker then has code execution on the agent host, steals LLM API keys and tool credentials, and uses the agents' access to reach internal data and systems.

Weaknesses (CWE)

CWE-94Improper Control of Generation of Code ('Code Injection')Primary CWE-94Improper Control of Generation of Code ('Code Injection')Primary CWE-94Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.