CVE-2026-61447: PraisonAI RCE Vulnerability

CVE-2026-61447 Overview

CVE-2026-61447 is a remote code execution vulnerability in PraisonAI versions before 1.6.78. The flaw exists in the CodeAgent._execute_python() function, which executes Python code generated by a large language model (LLM). The function performs no Abstract Syntax Tree (AST) validation, no import restrictions, and no sandbox enforcement. Attackers can manipulate LLM output through prompt injection to execute arbitrary code on the host system and exfiltrate environment secrets. The vulnerability is classified under [CWE-94] (Improper Control of Generation of Code).

Critical Impact
Unauthenticated remote attackers can exfiltrate all environment secrets and execute arbitrary Python code on the host running PraisonAI by influencing LLM output through prompt injection.

Affected Products

PraisonAI versions prior to 1.6.78
Deployments using the CodeAgent component
Applications embedding PraisonAI agent workflows with LLM-generated code execution

Discovery Timeline

2026-07-11 - CVE-2026-61447 published to the National Vulnerability Database (NVD)
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-61447

Vulnerability Analysis

PraisonAI is a multi-agent framework that lets LLMs orchestrate tasks, including the generation and execution of Python code. The CodeAgent._execute_python() method takes code produced by the LLM and passes it directly to a Python execution context. No safety layer inspects the code before execution. The impact scope spans the process running PraisonAI, meaning any credentials, API keys, or files reachable by the process become accessible to the attacker.

Root Cause

The root cause is missing validation of untrusted code before execution. The _execute_python() implementation does not parse the incoming source into an AST to reject dangerous nodes such as Import, ImportFrom, Call to eval, exec, or __import__. It does not restrict Python's built-in namespace, and it does not run the code inside a sandbox, container, or restricted subprocess. Because the code originates from an LLM whose output can be steered by user-controlled prompt content, the trust boundary between untrusted user input and privileged code execution collapses.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction. An attacker submits a crafted prompt to any interface that feeds user input into an LLM-driven PraisonAI workflow. The attacker instructs the LLM to emit Python code that reads environment variables, opens a reverse shell, or writes to the file system. When CodeAgent._execute_python() receives the generated code, it runs with the privileges of the host process. Prompt injection through indirect channels, such as retrieved documents or tool outputs, is also viable.

No verified public exploit code is available at this time. See the GitHub Security Advisory and the VulnCheck Advisory on PraisonAI for further technical details.

Detection Methods for CVE-2026-61447

Indicators of Compromise

Unexpected outbound network connections originating from the PraisonAI process, especially to unknown IP addresses or paste sites.
Process trees showing the Python interpreter spawning shells (sh, bash, cmd.exe, powershell.exe) or system utilities (curl, wget, nc).
Access to .env files, cloud credential paths (~/.aws/credentials, ~/.config/gcloud), or SSH keys by the PraisonAI process.
LLM prompt or response logs containing import os, subprocess, __import__, or base64-encoded payloads.

Detection Strategies

Instrument the PraisonAI application to log every string passed to CodeAgent._execute_python() and alert on high-risk tokens.
Deploy endpoint telemetry to correlate Python interpreter activity with child process creation and file access patterns.
Review LLM request and response logs for prompt injection patterns targeting code generation agents.

Monitoring Recommendations

Baseline the network destinations and syscalls of PraisonAI workloads, then alert on deviations.
Monitor read access to environment variable stores and secret files by any process hosting PraisonAI.
Track PraisonAI package versions across the fleet and flag any host running a release earlier than 1.6.78.

How to Mitigate CVE-2026-61447

Immediate Actions Required

Upgrade PraisonAI to version 1.6.78 or later on every host where it is installed.
Rotate all secrets, API keys, and tokens that were exposed to the PraisonAI process, since exfiltration cannot be ruled out.
Restrict network egress from PraisonAI hosts to only the destinations required for operation.
Audit LLM prompt logs for evidence of injection attempts targeting the CodeAgent.

Patch Information

The maintainers of PraisonAI released version 1.6.78 to address CVE-2026-61447. Details are published in the GitHub Security Advisory GHSA-2xv2-w8cq-5gxw. Upgrade using the standard package manager, for example pip install --upgrade praisonai, and confirm the installed version before returning the service to production.

Workarounds

Disable the CodeAgent or any workflow that invokes _execute_python() until the patched version is deployed.
Execute LLM-generated code inside an isolated sandbox such as a hardened container, a seccomp-restricted subprocess, or a dedicated microVM with no access to secrets.
Enforce an allowlist of imports and built-ins by wrapping code execution in an AST validator that rejects Import, ImportFrom, and dangerous function calls.
Remove sensitive environment variables from the process running PraisonAI and inject secrets through a broker that enforces per-request authorization.

bash

# Configuration example: upgrade and verify PraisonAI
pip install --upgrade "praisonai>=1.6.78"
python -c "import praisonai; print(praisonai.__version__)"

# Restrict outbound network egress for the service (Linux nftables example)
nft add table inet praisonai
nft add chain inet praisonai output { type filter hook output priority 0 \; policy drop \; }
nft add rule inet praisonai output oifname "lo" accept
nft add rule inet praisonai output ip daddr <llm-api-ip> tcp dport 443 accept