CVE-2026-60086: PraisonAI Prompt Injection Bypass Flaw

CVE-2026-60086 Overview

CVE-2026-60086 is a prompt injection defense bypass vulnerability affecting PraisonAI versions prior to 4.6.78. The framework's injection defense only blocks prompts classified as CRITICAL, which requires three or more detector families to match simultaneously. Attackers can craft single-vector or double-vector prompt injections that receive a HIGH threat classification and pass through the filter unblocked. These payloads reach the underlying language model and can manipulate its behavior. The flaw is tracked under [CWE-693: Protection Mechanism Failure] and carries a CVSS 4.0 score of 6.9.

Critical Impact
Attackers can bypass PraisonAI's built-in prompt injection defense to deliver malicious instructions directly to backing language models, undermining agent integrity guarantees.

Affected Products

PraisonAI versions prior to 4.6.78
Agentic workflows built on PraisonAI relying on the built-in injection defense
Downstream applications integrating PraisonAI as their prompt safety layer

Discovery Timeline

2026-07-10 - CVE-2026-60086 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-60086

Vulnerability Analysis

PraisonAI implements a prompt injection defense that evaluates incoming prompts against multiple detector families. Each detector family flags patterns associated with a specific injection technique, such as instruction override, role manipulation, or system prompt extraction. The defense aggregates detector matches into a threat classification and blocks the prompt only when the classification reaches CRITICAL. Reaching CRITICAL requires three or more detector families to fire on the same input. Prompts that trigger one or two detector families are classified as HIGH and forwarded to the model without modification. This threshold leaves a wide gap through which single-vector and double-vector injection payloads pass unblocked. The design assumes that attackers must combine several techniques to succeed, which does not match observed injection tradecraft.

Root Cause

The root cause is a protection mechanism failure in the classification logic. The defense equates severity with detector family count rather than with the risk of any individual technique. A well-crafted single-vector payload can fully compromise model behavior without triggering additional detectors. Because HIGH prompts are allowed through, the effective policy blocks only unsophisticated multi-vector attacks.

Attack Vector

Exploitation requires network-reachable access to a PraisonAI endpoint that accepts user prompts. No authentication or user interaction is required. An attacker submits a prompt containing a single injection technique, such as a direct instruction override or a role reassignment sequence. The defense scores the prompt as HIGH, permits it to pass, and the underlying model processes the attacker-controlled instructions. Impact is limited to integrity of model output, consistent with the CVSS vector's VI:L rating and no confidentiality or availability effect.

No verified proof-of-concept code has been published. Refer to the GitHub Security Advisory and VulnCheck Advisory for further technical detail.

Detection Methods for CVE-2026-60086

Indicators of Compromise

Model outputs that contradict the configured system prompt or agent role
Prompt logs showing HIGH-classified inputs that were forwarded to the model
Unexpected tool invocations or data exfiltration attempts originating from agent sessions
Repeated prompts from a single source containing instruction override phrasing such as ignore previous instructions or you are now

Detection Strategies

Enable verbose logging of the injection defense classifier and capture per-prompt detector family hits alongside the final classification.
Alert on any prompt where one or two detector families fire, since these bypass the CRITICAL block threshold.
Perform offline replay of stored prompts against an updated classifier to identify historical bypass attempts.

Monitoring Recommendations

Monitor PraisonAI application logs for prompts classified as HIGH and correlate with downstream tool actions.
Track anomalous agent behavior such as unauthorized API calls, credential access, or deviation from expected task scope.
Baseline normal prompt-length and token distributions and alert on statistical outliers indicative of crafted payloads.

How to Mitigate CVE-2026-60086

Immediate Actions Required

Upgrade PraisonAI to version 4.6.78 or later on all deployments.
Audit existing agent configurations that depend on the built-in injection defense as their sole safety control.
Rotate any secrets or API keys that could have been exposed through manipulated agent behavior.

Patch Information

The vulnerability is fixed in PraisonAI 4.6.78. The fix lowers the block threshold so that HIGH-classified prompts are also rejected, removing the single- and double-vector bypass. Patch details are documented in the GitHub Security Advisory GHSA-4r3p-w3mc-5v34.

Workarounds

Place an independent prompt-filtering layer in front of PraisonAI until the upgrade is completed.
Restrict agent tool permissions to the minimum required set to limit the blast radius of a successful injection.
Add allow-listing on user input for high-risk agents, rejecting prompts containing common override phrases.
Require human review for agent actions that touch sensitive data or external systems.

bash

# Upgrade PraisonAI to the patched release
pip install --upgrade "praisonai>=4.6.78"

# Verify installed version
python -c "import praisonai; print(praisonai.__version__)"