# CVE-2026-61443: MervinPraison PraisonAI remote code execution in SkillTools

Source: https://junglewise.ai/threats/cve-2026-61443-mervinpraison-praisonai-remote-code-execution-in-skilltools  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-61443 · Severity: high · CVSS 8.1 · Published 2026-07-15

PraisonAI, a framework for managing AI agents, contains a security flaw in its script execution tool. An attacker can bypass intended directory restrictions to run arbitrary scripts located anywhere on the host system. This could lead to a full system takeover, especially in Docker environments where the application often runs with administrative (root) privileges.

Technologies: [praisonaiagents (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonaiagents). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-61443 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61443 being exploited in the wild.

**How severe is CVE-2026-61443?** High severity, with a CVSS score of 8.1, published 15 July 2026.

**Which products and versions are affected?** praisonaiagents (PyPI) <= 1.6.77, ECOSYSTEM:introduced=0,fixed=1.6.78.

**Is there a fix for CVE-2026-61443?** Yes. praisonaiagents (PyPI): upgrade to 1.6.78 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61443 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-61443?** Check whether you run praisonaiagents (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- praisonaiagents (PyPI): upgrade to 1.6.78 or later

  ```sh
  pip install "praisonaiagents>=1.6.78"
  ```


## Technical details

A path traversal and remote code execution vulnerability exists in the SkillTools.run_skill_script() function of PraisonAI. Unlike the FileTools component, SkillTools fails to implement path containment validation, allowing the script_path parameter to accept absolute paths outside the designated working directory. An attacker with low privileges can trigger the execution of arbitrary scripts via subprocess.run(). This is particularly critical in Docker deployments where the process typically runs as root, and can be chained with file-write vulnerabilities to achieve full remote code execution. The issue is resolved in version 1.6.78.

## Affected products

- MervinPraison PraisonAI < 1.6.78

## Identifiers

- CVE-2026-61443
- GHSA-c44f-37qr-gw3f
- PYSEC-2026-4270

## Timeline

- 2026-06-25: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: NVD publication date

## References

- [https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-c44f-37qr-gw3f](https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-c44f-37qr-gw3f)
- [https://www.vulncheck.com/advisories/praisonai-before-remote-code-execution-via-skilltools](https://www.vulncheck.com/advisories/praisonai-before-remote-code-execution-via-skilltools)

## Related threats

- [PraisonAI SearxNG URL validation bypass in search tools](https://junglewise.ai/threats/cve-2026-57143-praisonai-server-side-request-forgery-ssrf-in-searxng-search-web)
- [PraisonAI missing access control in API endpoints](https://junglewise.ai/threats/cve-2026-57118-praisonai-agentteam-launch-exposes-unauthenticated-remote-agent)
- [PraisonAI legacy SSE endpoint CORS and authentication bypass](https://junglewise.ai/threats/cve-2026-57112-praisonai-legacy-sse-endpoint-cors-and-authentication-bypass)
- [PraisonAI IMAP injection in email tools](https://junglewise.ai/threats/cve-2026-57130-praisonai-imap-injection-in-email-tools)
- [PraisonAI path traversal in file mention parsing](https://junglewise.ai/threats/cve-2026-57129-praisonai-path-traversal-in-file-mention-parsing)