CVE-2026-61438: PraisonAI RCE Vulnerability

CVE-2026-61438 Overview

CVE-2026-61438 is a remote code execution vulnerability in PraisonAI versions before 4.6.78. The flaw resides in the JobWorkflowExecutor._exec_inline_python() function, which performs insufficient Abstract Syntax Tree (AST) validation on workflow script steps. Attackers can craft malicious YAML workflow files that combine import os statements with subsequent os.system() calls to bypass the sandbox and execute arbitrary operating system commands. The vulnerability is categorized under [CWE-78] (OS Command Injection) and requires local access with low privileges plus user interaction to exploit.

Critical Impact
Successful exploitation grants attackers arbitrary OS command execution with the privileges of the PraisonAI process, compromising confidentiality, integrity, and availability of the host system.

Affected Products

PraisonAI versions prior to 4.6.78
Deployments processing untrusted YAML workflow files
Environments invoking JobWorkflowExecutor._exec_inline_python()

Discovery Timeline

2026-07-15 - CVE-2026-61438 published to the National Vulnerability Database (NVD)
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-61438

Vulnerability Analysis

PraisonAI processes user-supplied workflow definitions written in YAML. Inline Python steps within these workflows are passed to JobWorkflowExecutor._exec_inline_python(), which relies on AST inspection to enforce a sandbox. The AST validator fails to correctly identify code patterns that first import the os module and then invoke os.system() in a later statement. Attackers exploit this gap by splitting the malicious behavior across multiple AST nodes, defeating the pattern checks that assume dangerous calls appear as a single expression.

Once the check passes, the workflow executor runs the untrusted Python inline, granting the attacker execution in the same process context as PraisonAI. The impact includes command execution, file system access, credential theft, and lateral movement.

Root Cause

The root cause is incomplete AST-based sandbox validation. The validator inspects individual statements without tracking symbol bindings introduced by preceding import statements. Because the os module is only forbidden as a top-level attribute at the moment a call is made, sequential import-then-invoke patterns slip through undetected.

Attack Vector

An attacker with the ability to submit or modify a YAML workflow file supplies an inline Python step containing an import os statement followed by an os.system() call carrying the attacker's payload. When the workflow runs, the sandbox check passes and the payload executes with the PraisonAI process privileges. Exploitation requires user interaction to trigger workflow execution. See the GitHub Security Advisory and the VulnCheck Advisory for additional technical detail.

Detection Methods for CVE-2026-61438

Indicators of Compromise

YAML workflow files containing import os immediately followed by os.system, os.popen, or subprocess invocations within inline Python steps
Unexpected child processes spawned by the PraisonAI worker (for example, sh, bash, curl, wget, python -c)
Outbound network connections initiated by the PraisonAI process to unfamiliar hosts
New or modified files under directories writable by the PraisonAI service account following workflow execution

Detection Strategies

Perform static analysis of ingested workflow YAML files for high-risk Python primitives such as os, subprocess, pty, socket, and ctypes
Monitor process ancestry to alert when the PraisonAI process creates shell interpreters or scripting utilities
Correlate workflow submission events with subsequent command execution telemetry on the host

Monitoring Recommendations

Enable command-line auditing (Linux execve via auditd or Windows Process Creation events) on hosts running PraisonAI
Forward workflow submission logs and process telemetry to a centralized analytics platform for correlation
Baseline normal PraisonAI process behavior and alert on deviations such as new binaries, listeners, or outbound traffic

How to Mitigate CVE-2026-61438

Immediate Actions Required

Upgrade PraisonAI to version 4.6.78 or later on all systems
Restrict who can submit or edit workflow YAML files to trusted operators only
Audit existing workflow definitions for suspicious import os or subprocess usage before re-enabling execution
Run the PraisonAI service under a dedicated, least-privileged account

Patch Information

The fix is available in PraisonAI 4.6.78. The maintainers hardened JobWorkflowExecutor._exec_inline_python() AST validation to detect module imports paired with dangerous call sites. Refer to the GitHub Security Advisory GHSA-26mh-57q7-jfvr for release details.

Workarounds

Disable inline Python steps in workflows until the patched version is deployed
Execute PraisonAI inside a container or sandbox with seccomp, AppArmor, or SELinux policies blocking shell execution and outbound network access
Apply file system permissions that prevent untrusted users from writing to the workflow directory
Add pre-ingestion review or automated linting to reject YAML files referencing os, subprocess, or other high-risk modules

bash

# Configuration example: upgrade PraisonAI and enforce least privilege
pip install --upgrade 'praisonai>=4.6.78'

# Run PraisonAI under a dedicated non-privileged user
sudo useradd --system --shell /usr/sbin/nologin praisonai
sudo -u praisonai praisonai --workflow /srv/praisonai/workflows/job.yaml