CVE-2026-61445 Overview
CVE-2026-61445 affects PraisonAI versions prior to 4.6.78. The vulnerability exists in the AICoder component, which processes Large Language Model (LLM) tool calls without adequate path validation or command sanitization. Attackers with low-privilege access to the chat interface can inject malicious prompts that trigger arbitrary file writes to any filesystem location and execute arbitrary shell commands with root privileges. The flaw is categorized under [CWE-22] (Path Traversal) and enables full system compromise through the AI agent framework's tool-calling functionality.
Critical Impact
Attackers can write files to arbitrary filesystem locations and execute shell commands as root through crafted LLM prompts, resulting in complete host compromise.
Affected Products
- PraisonAI versions prior to 4.6.78
- Deployments exposing the AICoder component via chat interface
- Systems running PraisonAI agents with root privileges
Discovery Timeline
- 2026-07-11 - CVE-2026-61445 published to NVD
- 2026-07-14 - Last updated in NVD database
Technical Details for CVE-2026-61445
Vulnerability Analysis
The vulnerability resides in PraisonAI's AICoder component, an LLM-driven code execution module that accepts tool calls generated from user prompts. The component fails to validate file paths passed to write operations and does not sanitize command strings before execution. This allows a prompt-injection payload to escape the intended working directory and reach sensitive filesystem locations such as /etc, /root, or systemd unit directories.
Because PraisonAI agents commonly run with elevated privileges in containerized or server deployments, exploitation grants adversaries the same privileges as the host process. In default configurations that run as root, this results in unrestricted host control. The vulnerability is exploitable over the network by any authenticated user of the chat interface.
Root Cause
The root cause is missing path validation and missing command sanitization on LLM-generated tool call parameters. The AICoder component trusts the model's output as safe input and forwards paths directly to filesystem write APIs and command strings directly to a shell interpreter. There is no allowlist, canonicalization step, or subprocess argument separation.
Attack Vector
An authenticated attacker submits a crafted prompt through the PraisonAI chat interface. The prompt instructs the LLM to invoke a tool call with a traversal path such as ../../../etc/cron.d/backdoor or with a shell command containing metacharacters. The AICoder component executes the request without validation. The attacker obtains code execution as the PraisonAI process user, typically root.
See the GitHub Security Advisory GHSA-9mp3-24cc-77mg and the VulnCheck Advisory for additional technical detail.
Detection Methods for CVE-2026-61445
Indicators of Compromise
- Files written outside the PraisonAI working directory, particularly in /etc, /root, /var/spool/cron, or systemd paths
- Child processes spawned by the PraisonAI process executing sh, bash, curl, wget, or python with unexpected arguments
- New or modified SSH authorized_keys entries on hosts running PraisonAI
- Outbound network connections from the PraisonAI process to attacker-controlled infrastructure
Detection Strategies
- Monitor PraisonAI application logs for tool call parameters containing path traversal sequences such as ../ or absolute paths outside the expected sandbox
- Alert on process ancestry where the PraisonAI process is the parent of shell interpreters or system utilities
- Inspect chat prompt logs for keywords targeting file write or command execution tool calls with suspicious arguments
Monitoring Recommendations
- Enable filesystem auditing (auditd or eBPF-based sensors) on directories outside the PraisonAI application root
- Log and retain all LLM tool call invocations, including full parameters, for retrospective analysis
- Correlate chat session identifiers with process and file activity to attribute malicious actions to specific users
How to Mitigate CVE-2026-61445
Immediate Actions Required
- Upgrade PraisonAI to version 4.6.78 or later immediately
- Restrict access to the PraisonAI chat interface to trusted, authenticated users only
- Run the PraisonAI process as a non-root, unprivileged service account
- Audit filesystem and process activity for signs of prior exploitation
Patch Information
The vendor has released PraisonAI 4.6.78, which introduces path validation and command sanitization in the AICoder component. Refer to the GitHub Security Advisory GHSA-9mp3-24cc-77mg for the fix commit and release notes.
Workarounds
- Disable the AICoder component or its file write and shell execution tools if patching cannot be applied immediately
- Deploy PraisonAI inside a container with a read-only root filesystem and dropped Linux capabilities
- Enforce network egress restrictions on the PraisonAI host to limit post-exploitation reachability
- Apply mandatory access controls (AppArmor or SELinux) that confine PraisonAI to a defined path and syscall set
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
