Skip to content
CVE PROGRAM SOURCE RECORD9.4 Critical

CVE-2026-61444

PraisonAI before 4.6.78 Code Injection via f-string

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

PraisonAI versions before 4.6.78 contain a code injection vulnerability in deploy/api.py where the agents_file parameter is directly interpolated into an f-string without sanitization. Attackers can inject arbitrary Python code that executes when the generated server code runs via subprocess.Popen().

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MervinPraison PraisonAI

Default version status: unaffected

  • 0 to < 4.6.78affected
  • 4.6.78unaffected
pkg:pypi/praisonai

References