Executive brief
PraisonAI is an AI agent framework used to automate tasks using Large Language Models (LLMs). A vulnerability in its code execution component allows the AI to run arbitrary Python code on the host system without any security restrictions or sandboxing. An attacker could use prompt injection to trick the AI into stealing sensitive information like API keys and database passwords, or to take full control of the server running the application.
Technical details
A remote code execution (RCE) vulnerability exists in the `CodeAgent._execute_python()` method of PraisonAI. The component executes LLM-generated Python code in a subprocess using `os.environ.copy()`, which exposes the entire parent process environment (including sensitive API keys and credentials) to the generated code. Furthermore, the implementation lacks Abstract Syntax Tree (AST) validation, import restrictions, and fails to enforce sandboxing even when explicitly configured. An attacker can exploit this via prompt injection to execute arbitrary system commands or exfiltrate environment variables. The issue is addressed in version 1.6.78.
Affected products
- MervinPraison PraisonAI < 1.6.78
Timeline
- 2026-06-25: advisory: GitHub Security Advisory published by maintainer
- 2026-07-11: disclosed: CVE published to NVD