CVE-2026-61444 Overview
CVE-2026-61444 is a code injection vulnerability [CWE-94] affecting PraisonAI versions before 4.6.78. The flaw resides in deploy/api.py, where the agents_file parameter is interpolated directly into a Python f-string without sanitization. When the generated server code executes through subprocess.Popen(), attacker-supplied Python statements run in the host process. Successful exploitation grants arbitrary code execution on the deployment host, exposing agent configurations, credentials, and downstream services connected to the PraisonAI runtime.
Critical Impact
Authenticated attackers can inject arbitrary Python code into generated PraisonAI server code, achieving remote code execution on the host through subprocess.Popen() invocation.
Affected Products
- PraisonAI versions prior to 4.6.78
- Deployments using deploy/api.py to generate agent server code
- Environments exposing the agents_file parameter to untrusted input
Discovery Timeline
- 2026-07-10 - CVE-2026-61444 published to NVD
- 2026-07-10 - Last updated in NVD database
Technical Details for CVE-2026-61444
Vulnerability Analysis
PraisonAI provides a deployment helper that generates a Python server file from user-supplied parameters. The agents_file value is embedded into a Python source template using an f-string. Because the template performs no escaping, quoting, or allowlisting, any characters supplied by the caller become part of the generated source code. The deployment routine then launches the generated file with subprocess.Popen(), executing whatever Python statements the attacker inserted. The Exploit Prediction Scoring System (EPSS) currently rates the probability of exploitation at 0.392%.
Root Cause
The root cause is unsafe string interpolation of untrusted input into executable code. The f-string treats agents_file as a code fragment rather than data. Standard defenses such as shlex.quote(), ast.literal_eval(), or parameterized templating are absent. Classified under [CWE-94] Improper Control of Generation of Code, the flaw allows an attacker to break out of the intended string context and append arbitrary Python expressions or statements.
Attack Vector
An attacker with access to the deployment API supplies a crafted agents_file value containing Python payload characters such as newline delimiters, quote breaks, or expression separators. When PraisonAI writes the generated server file and invokes subprocess.Popen(), the injected payload executes with the privileges of the PraisonAI process. Depending on deployment context, this can pivot to filesystem access, credential theft, or lateral movement across connected AI agents and data stores. See the GitHub Security Advisory and the VulnCheck Advisory for technical details.
Detection Methods for CVE-2026-61444
Indicators of Compromise
- Unexpected child processes spawned from the PraisonAI service account, particularly python subprocesses launching non-standard scripts.
- Generated server files in the PraisonAI deployment directory containing syntactically anomalous Python payloads or shell commands.
- Outbound network connections from the PraisonAI host to attacker-controlled infrastructure following calls to the deploy API.
Detection Strategies
- Inspect calls to the deploy/api.py endpoint for agents_file values containing quotes, backslashes, newlines, or Python keywords such as import, exec, or os.system.
- Correlate subprocess.Popen() invocations by PraisonAI with newly written files in the deployment directory to identify injected content.
- Apply [CWE-94] focused rules to Python application logs to flag dynamic code generation events.
Monitoring Recommendations
- Enable process ancestry logging on hosts running PraisonAI to capture parent-child relationships around Python invocations.
- Forward application logs from the PraisonAI API into a centralized data lake and alert on anomalous agents_file parameter content.
- Monitor egress traffic from PraisonAI hosts for connections to unfamiliar domains or IP ranges after deployment API activity.
How to Mitigate CVE-2026-61444
Immediate Actions Required
- Upgrade PraisonAI to version 4.6.78 or later on all deployment hosts.
- Restrict network access to the deploy/api.py endpoint to trusted administrative users and networks.
- Audit historical requests to the deploy API for anomalous agents_file values and inspect hosts for signs of prior exploitation.
Patch Information
The maintainers released a fix in PraisonAI version 4.6.78. Refer to the GitHub Security Advisory GHSA-g6j7-pffp-8whg for patch details and upgrade guidance.
Workarounds
- Place the PraisonAI deploy API behind an authenticated reverse proxy that enforces strict input validation on agents_file.
- Run PraisonAI under a dedicated least-privilege service account with no write access outside its working directory.
- Disable or remove the deployment endpoint in production environments where dynamic agent file generation is not required.
# Upgrade PraisonAI to the patched release
pip install --upgrade "praisonai>=4.6.78"
# Verify installed version
pip show praisonai | grep -i version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
