Executive brief
PraisonAI, an AI agent framework, contains a flaw in its optional prompt injection defense system. The security feature is designed to block malicious instructions sent to AI models, but it currently only triggers when a very high threshold of suspicious patterns is met. This allows attackers to bypass the defense using standard techniques, potentially leading to unauthorized actions or data manipulation by the AI agent.
Technical details
A protection mechanism failure (CWE-693) exists in PraisonAI's opt-in prompt injection defense (enable_injection_defense). The 'scan_text' function in 'injection.py' only blocks inputs if they reach a 'CRITICAL' threat level, which requires three or more detector families to trigger simultaneously. Standard single- or double-vector prompt injections are classified as 'HIGH' and are allowed to pass to the model unblocked. Additionally, the documented 'sanitize' behavior for 'HIGH' threat levels was not implemented in affected versions. This allows remote attackers to bypass the injection filter and deliver malicious payloads to the underlying LLM. The issue is resolved in version 4.6.78.
Affected products
- MervinPraison PraisonAI < 4.6.78
Timeline
- 2026-06-25: advisory: GitHub Security Advisory published
- 2026-07-10: disclosed: NVD publication date