CVE-2026-61444

EUVD-2026-42902
PraisonAI versions before 4.6.78 contain a code injection vulnerability in deploy/api.py where the agents_file parameter is directly interpolated into an f-string without sanitization. Attackers can inject arbitrary Python code that executes when the generated server code runs via subprocess.Popen().
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.1 CRITICAL
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-g6j7-pffp-8whg
https://www.vulncheck.com/advisories/praisonai-before-code-injection-via-f-string
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-g6j7-pffp-8whg