CVE-2026-61444
criticalpriority · track · 0EPSS 0.005 · 42 %ileEUUSEPSS · scored 2026-10-27
PraisonAI versions before 4.6.78 contain a code injection vulnerability in deploy/api.py where the agents_file parameter is directly interpolated into an f-string without sanitization. Attackers can inject arbitrary Python code that executes when the generated server code runs via subprocess.Popen().
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.6–9.4
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
advisories (3)
Vendor and ecosystem advisories describing this.
- GHSA-g6j7-pffp-8whgPraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation2026-10-07ghsa · osvUS
### Summary The `deploy/api.py` module generates Python server code by directly interpolating the `agents_file` parameter into an f-string that is then written to a file and executed via `subprocess.Popen()`. An attacker who controls the `agents_file` value (via CLI argument, configuration, or upstream API) can inject arbitrary Python code. ### Details `src/praisonai/praisonai/deploy/api.py` (line 80): ```python code = f'''... praisonai = PraisonAI(agent_file="{agents_file}") ... "agent_file": "{agents_file}" ...''' ``` The generated code is then executed (line 190): ```python subprocess.Popen(['python', server_file]) ``` `agents_file` is never sanitized or validated. A malicious value breaks out of the string context: ```python agents_file = '"); import os; os.system("id"); #' # Generated code becomes: # praisonai = PraisonAI(agent_file=""); import os; os.system("id"); #") ``` The same pattern exists in `deploy/docker.py` (line 33) for Dockerfile generation. ### PoC ```python # The injection: agents_file = '"); import os; os.system("id"); #' # What the generated code looks like: template = f'praisonai = PraisonAI(agent_file="{agents_file}")' print(template) # Output: praisonai = PraisonAI(agent_file=""); import os; os.system("id"); #") ``` ### Impact - **Arbitrary code execution** on the machine running the deploy command - **Supply chain risk** if `agents_file` comes from a configuration file or CI/CD pipeline
- CVE-2026-62176PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation2026-10-07vendor · osvUS
PraisonAI is a multi-agent teams system. Prior to version 4.6.78, the `deploy/api.py` module generates Python server code by directly interpolating the `agents_file` parameter into an f-string that is then written to a file and executed via `subprocess.Popen()`. An attacker who controls the `agents_file` value (via CLI argument, configuration, or upstream API) can inject arbitrary Python code. Version 4.6.78 patches the issue.
- PYSEC-2026-4256PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation2026-10-15vendor · osvUS
### Summary The `deploy/api.py` module generates Python server code by directly interpolating the `agents_file` parameter into an f-string that is then written to a file and executed via `subprocess.Popen()`. An attacker who controls the `agents_file` value (via CLI argument, configuration, or upstream API) can inject arbitrary Python code. ### Details `src/praisonai/praisonai/deploy/api.py` (line 80): ```python code = f'''... praisonai = PraisonAI(agent_file="{agents_file}") ... "agent_file": "{agents_file}" ...''' ``` The generated code is then executed (line 190): ```python subprocess.Popen(['python', server_file]) ``` `agents_file` is never sanitized or validated. A malicious value breaks out of the string context: ```python agents_file = '"); import os; os.system("id"); #' # Generated code becomes: # praisonai = PraisonAI(agent_file=""); import os; os.system("id"); #") ``` The same pattern exists in `deploy/docker.py` (line 33) for Dockerfile generation. ### PoC ```python # The injection: agents_file = '"); import os; os.system("id"); #' # What the generated code looks like: template = f'praisonai = PraisonAI(agent_file="{agents_file}")' print(template) # Output: praisonai = PraisonAI(agent_file=""); import os; os.system("id"); #") ``` ### Impact - **Arbitrary code execution** on the machine running the deploy command - **Supply chain risk** if `agents_file` comes from a configuration file or CI/CD pipeline
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (6)
External citations — patches, advisories, analysis.
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-g6j7-pffp-8whgcnnvd
- https://www.vulncheck.com/advisories/praisonai-before-code-injection-via-f-stringcnnvd
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-g6j7-pffp-8whgenisa_euvd
- https://www.vulncheck.com/advisories/praisonai-before-code-injection-via-f-stringenisa_euvd
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-g6j7-pffp-8whgnvd
- https://www.vulncheck.com/advisories/praisonai-before-code-injection-via-f-stringnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan