CVE-2026-61447: MervinPraison PraisonAI remote code execution in CodeAgent

CVE-2026-61447 · Severity: critical · CVSS 10 · Published 2026-07-11

PraisonAI is an AI agent framework used to automate tasks using Large Language Models (LLMs). A vulnerability in its code execution component allows the AI to run arbitrary Python code on the host system without any security restrictions or sandboxing. An attacker could use prompt injection to trick the AI into stealing sensitive information like API keys and database passwords, or to take full control of the server running the application.

Technologies: praisonaiagents (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-61447 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-61447 being exploited in the wild.
How severe is CVE-2026-61447?
Critical severity, with a CVSS score of 10, published 11 July 2026.
Which products and versions are affected?
praisonaiagents (PyPI) <= 1.6.77, ECOSYSTEM:introduced=0,fixed=1.6.78.
Is there a fix for CVE-2026-61447?
Yes. praisonaiagents (PyPI): upgrade to 1.6.78 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61447 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-61447?
Check whether you run praisonaiagents (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • praisonaiagents (PyPI): upgrade to 1.6.78 or later
    pip install "praisonaiagents>=1.6.78"

Technical details

A remote code execution (RCE) vulnerability exists in the `CodeAgent._execute_python()` method of PraisonAI. The component executes LLM-generated Python code in a subprocess using `os.environ.copy()`, which exposes the entire parent process environment (including sensitive API keys and credentials) to the generated code. Furthermore, the implementation lacks Abstract Syntax Tree (AST) validation, import restrictions, and fails to enforce sandboxing even when explicitly configured. An attacker can exploit this via prompt injection to execute arbitrary system commands or exfiltrate environment variables. The issue is addressed in version 1.6.78.

Affected products

  • MervinPraison PraisonAI < 1.6.78

Identifiers

  • CVE-2026-61447
  • GHSA-2xv2-w8cq-5gxw
  • PYSEC-2026-4266

Timeline

  • 2026-06-25: advisory: GitHub Security Advisory published by maintainer
  • 2026-07-11: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.