CVE-2026-61438: MervinPraison PraisonAI remote code execution in JobWorkflowExecutor

CVE-2026-61438 · Severity: high · CVSS 7.3 · Published 2026-07-15

PraisonAI, an AI agent framework, is vulnerable to a security flaw that allows the execution of unauthorized commands. By providing a specially crafted workflow file, an attacker can bypass the software's safety checks to run arbitrary code on the host system. This could lead to a full system compromise, data theft, or unauthorized access to corporate resources, especially in environments where AI workflows are shared or automated.

Technologies: praisonai (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-61438 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-61438 being exploited in the wild.
How severe is CVE-2026-61438?
High severity, with a CVSS score of 7.3, published 15 July 2026.
Which products and versions are affected?
praisonai (PyPI) < 4.6.78, ECOSYSTEM:introduced=0,fixed=4.6.78.
Is there a fix for CVE-2026-61438?
Yes. praisonai (PyPI): upgrade to 4.6.78 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61438 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-61438?
Check whether you run praisonai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • praisonai (PyPI): upgrade to 4.6.78 or later
    pip install "praisonai>=4.6.78"

Technical details

A remote code execution vulnerability exists in PraisonAI's JobWorkflowExecutor._exec_inline_python() function due to a broken Abstract Syntax Tree (AST) sandbox. While the application attempts to restrict Python execution by checking AST nodes against an allowlist and limiting builtins, it explicitly permits the 'os' module in its allowed_modules list. An attacker can exploit this by creating a YAML workflow file containing 'import os' followed by dangerous calls such as 'os.system()'. When a user or CI/CD pipeline executes this malicious workflow, the commands run with the full privileges of the calling process. The issue is addressed in version 4.6.78 by tightening module validation.

Affected products

  • MervinPraison PraisonAI < 4.6.78

Identifiers

  • CVE-2026-61438
  • GHSA-26mh-57q7-jfvr

Timeline

  • 2026-06-25: advisory: GitHub Security Advisory published
  • 2026-07-15: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.