CVE-2026-60085: MervinPraison PraisonAI unenforced security policy in Subprocess Sandbox

CVE-2026-60085 · Severity: high · CVSS 7.5 · Published 2026-07-15

PraisonAI, an AI agent framework, contains a flaw where its security sandbox fails to enforce configured restrictions. This allows an attacker to bypass "strict" security policies to run unauthorized commands, access sensitive system files, or delete data. Organizations using the default sandbox to run untrusted code are at risk of full system compromise.

Technologies: praisonai (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-60085 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-60085 being exploited in the wild.
How severe is CVE-2026-60085?
High severity, with a CVSS score of 7.5, published 15 July 2026.
Which products and versions are affected?
praisonai (PyPI) <= 4.6.77, ECOSYSTEM:introduced=0,fixed=4.6.78.
Is there a fix for CVE-2026-60085?
Yes. praisonai (PyPI): upgrade to 4.6.78 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-60085 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-60085?
Check whether you run praisonai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • praisonai (PyPI): upgrade to 4.6.78 or later
    pip install "praisonai>=4.6.78"

Technical details

A vulnerability exists in PraisonAI's Subprocess Sandbox backend (praisonai/sandbox/subprocess.py) where security policy configurations are not enforced. While the 'SecurityPolicy' class defines restrictions for blocked commands, paths, and imports, the default subprocess backend fails to consult these fields before executing code via asyncio.create_subprocess_exec(). An attacker can exploit this to achieve arbitrary command execution, read sensitive files like /etc/passwd, and perform destructive file operations even when 'SecurityPolicy.strict()' is enabled. The issue is resolved in version 4.6.78 by ensuring policy enforcement or using more robust backends like Landlock.

Affected products

  • MervinPraison PraisonAI < 4.6.78

Identifiers

  • CVE-2026-60085
  • GHSA-5r6c-gj4g-r697
  • PYSEC-2026-4250

Timeline

  • 2026-06-25: advisory: GitHub Security Advisory published
  • 2026-07-15: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.