CVE-2026-61445: MervinPraison PraisonAI arbitrary file write and command execution in AICoder

CVE-2026-61445 · Severity: critical · CVSS 9.9 · Published 2026-07-11

PraisonAI, an AI agent framework, contains a critical security flaw in its AICoder component. An attacker can use the chat interface to trick the AI into writing malicious files anywhere on the system or executing dangerous commands. Because the software often runs with high privileges (root) in Docker environments, this could allow a complete takeover of the server and access to all stored data.

Technologies: praisonai (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-61445 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-61445 being exploited in the wild.
How severe is CVE-2026-61445?
Critical severity, with a CVSS score of 9.9, published 11 July 2026.
Which products and versions are affected?
praisonai (PyPI) <= 4.6.77, ECOSYSTEM:introduced=0,fixed=4.6.78.
Is there a fix for CVE-2026-61445?
Yes. praisonai (PyPI): upgrade to 4.6.78 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61445 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-61445?
Check whether you run praisonai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • praisonai (PyPI): upgrade to 4.6.78 or later
    pip install "praisonai>=4.6.78"

Technical details

The AICoder component in PraisonAI fails to perform path validation and command sanitization when processing LLM tool calls for 'write_to_file' and 'execute_command'. Specifically, the 'write_to_file' function uses os.path.join in a way that allows absolute paths to override the intended working directory, enabling path traversal (CWE-22). The 'execute_command' function passes LLM-generated strings directly to a subprocess without sanitization, leading to OS command injection (CWE-78). An authenticated user can exploit these by providing malicious prompts that trigger the LLM to call these tools with attacker-controlled arguments. The impact is heightened in Docker deployments where the application typically runs as the root user.

Affected products

  • MervinPraison PraisonAI < 4.6.78

Identifiers

  • CVE-2026-61445
  • GHSA-9mp3-24cc-77mg
  • PYSEC-2026-4253

Timeline

  • 2026-06-25: advisory: GitHub Security Advisory published
  • 2026-07-11: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.