CVE-2026-61443 Overview
CVE-2026-61443 is a remote code execution vulnerability in PraisonAI versions prior to 1.6.78. The flaw resides in the SkillTools.run_skill_script() function, which executes scripts without validating path containment. Attackers can supply absolute file paths to execute arbitrary scripts from any filesystem location, including paths outside the intended working directory. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).
Critical Impact
Authenticated attackers with low privileges can execute arbitrary scripts on the host running PraisonAI, leading to full compromise of confidentiality and integrity.
Affected Products
- PraisonAI versions prior to 1.6.78
- Deployments using the SkillTools component
- Applications embedding PraisonAI agent workflows with skill script execution
Discovery Timeline
- 2026-07-15 - CVE-2026-61443 published to NVD
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-61443
Vulnerability Analysis
The vulnerability exists in the SkillTools.run_skill_script() method within PraisonAI. This function accepts a script path parameter and executes the referenced script without enforcing that the resolved path remains within a designated skills directory.
Because absolute paths are accepted without normalization or prefix checks, an attacker who can influence the script path argument can point execution at any script on the filesystem. This includes system binaries, temporary files, or scripts uploaded through other application channels. The result is arbitrary code execution in the context of the PraisonAI process.
The attack requires low privileges but no user interaction, and it is exploitable over the network wherever the PraisonAI skill interface is exposed. See the GitHub Security Advisory for full details.
Root Cause
The root cause is missing path containment validation in SkillTools.run_skill_script(). The function does not canonicalize the supplied path with functions such as os.path.realpath() and does not verify that the canonical path is a descendant of an allowlisted skills directory. Absolute paths and traversal sequences bypass any implicit restrictions.
Attack Vector
An attacker with authenticated access to the skill invocation interface supplies an absolute filesystem path as the script argument. PraisonAI resolves the path directly and executes the target script through its skill runner. The attacker can chain this with a prior file write primitive, or reference scripts already present on the host, to achieve command execution.
The vulnerability manifests when SkillTools.run_skill_script() is invoked with a caller-controlled path. Refer to the VulnCheck Security Advisory for exploitation context.
Detection Methods for CVE-2026-61443
Indicators of Compromise
- Execution of scripts from paths outside the expected PraisonAI skills directory by the PraisonAI process
- Child processes spawned by the PraisonAI runtime referencing absolute paths such as /tmp/, /var/tmp/, or user-writable directories
- Unexpected outbound network connections initiated shortly after skill invocation events
Detection Strategies
- Instrument PraisonAI logs to record every script path passed to SkillTools.run_skill_script() and alert on absolute paths or paths containing .. sequences
- Correlate skill invocation events with process creation telemetry to identify script executions originating outside the approved skills directory
- Compare running PraisonAI package versions against 1.6.78 using software inventory data to identify vulnerable deployments
Monitoring Recommendations
- Enable process auditing on hosts running PraisonAI and forward events to a centralized analytics platform
- Monitor for anomalous shell interpreters, python, or bash processes spawned by the PraisonAI service account
- Track filesystem writes to directories writable by the PraisonAI runtime, since these can serve as staging locations for attacker-supplied scripts
How to Mitigate CVE-2026-61443
Immediate Actions Required
- Upgrade PraisonAI to version 1.6.78 or later across all environments
- Restrict network access to PraisonAI skill endpoints to trusted callers only
- Audit application logs for prior invocations of SkillTools.run_skill_script() with suspicious path arguments
- Rotate credentials and API tokens accessible to the PraisonAI process if compromise is suspected
Patch Information
The maintainer released a fix in PraisonAI 1.6.78. The patched version enforces path containment so that SkillTools.run_skill_script() only executes scripts residing within the intended skills directory. Upgrade instructions are provided in the GitHub Security Advisory.
Workarounds
- If immediate upgrade is not possible, disable or remove the SkillTools skill runner from agent configurations
- Run PraisonAI under a dedicated low-privilege service account with a read-only filesystem where feasible
- Apply an application-layer proxy or wrapper that rejects skill script arguments containing absolute paths or traversal sequences
# Upgrade PraisonAI to the patched release
pip install --upgrade "praisonai>=1.6.78"
# Verify the installed version
pip show praisonai | grep -i version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
