Loading story…
A critical remote code execution flaw, CVE-2026-61447, was disclosed in the PraisonAI AI agent framework, affecting versions before 1.6.78. The vulnerability lies in CodeAgent._execute_python(), which executes LLM-generated Python without AST validation, import restrictions, or sandbox enforcement, allowing attackers to use prompt injection to make the agent run arbitrary code on the host. The issue received the maximum severity rating of CVSS 10.0 under both v3.1 and v4.0.
Successful exploitation can result in full host compromise and theft of sensitive data, including API keys, cloud credentials, database passwords, and other environment secrets, with potential pivoting into connected services. PraisonAI 1.6.78 fixes the issue, and defenders are being urged to upgrade immediately, reduce network exposure, rotate potentially exposed secrets, and monitor for anomalous outbound connections; no confirmed in-the-wild exploitation had been reported at disclosure time.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-11, CVE-2026-61447 was publicly disclosed as a critical remote code execution vulnerability in PraisonAI affecting versions prior to 1.6.78. The flaw allows prompt injection to influence LLM-generated Python code execution, potentially leading to arbitrary code execution and theft of environment secrets.
PraisonAI version 1.6.78 was identified as the fixed release for a critical remote code execution vulnerability in CodeAgent._execute_python() affecting versions before 1.6.78. The remediation guidance was to upgrade to 1.6.78 or later.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities in PraisonAI exposed its Python sandbox protections to bypass, allowing arbitrary code execution when untrusted agent code was run. `CVE-2026-39888` affected versions prior to `1.5.115` in `praisonaiagents.tools.python_tools.execute_code()` when `sandbox_mode` defaulted to `sandbox`; the subprocess wrapper relied on a restricted `__builtins__` dictionary and an incomplete AST blocklist that omitted frame-traversal attributes including `__traceback__`, `tb_frame`, `f_back`, and `f_builtins`. By catching an exception and traversing frames, an attacker could recover the real Python builtins from the wrapper frame and invoke `exec`, defeating the intended sandbox restrictions. A second flaw, `CVE-2026-40158`, affected PraisonAI versions prior to `4.5.128` in `_execute_code_direct` within `praisonaiagents/tools/python_tools.py`. That sandbox used AST filtering to block dangerous Python attributes, but only inspected `ast.Attribute` nodes and missed dynamic attribute resolution through built-in mechanisms such as `type.__getattribute__`. Attackers could therefore reach blocked capabilities such as `__subclasses__` through a trampoline technique because the string appeared as an `ast.Constant` rather than an `ast.Attribute`, undermining the protection model until the vendor patched the issue in `4.5.128`.
Jun 29, 2026
PraisonAI disclosed two high-severity vulnerabilities affecting its multi-agent teams platform, both tied to unsafe handling of templates. **CVE-2026-39891** affects versions before `4.5.115` and allows template injection through agent tool definitions: the `create_agent_centric_tools()` function returns tools that render file content as templates, so unescaped input supplied via `agent.start()` can cause template expressions to execute rather than be treated as plain text. The flaw is tracked as **CWE-94** and carries a CVSS v3.1 score vector of `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, indicating high impact across confidentiality, integrity, and availability. A second issue, **CVE-2026-40154**, affects versions before `4.5.128` and exposes PraisonAI to remote template code execution through untrusted externally fetched template files. The advisory says the product treated remote templates as trusted executable code without integrity checks, origin validation, or user confirmation, creating a supply-chain attack path for malicious templates. That vulnerability is mapped to **CWE-829** with CVSS v3.1 vector `AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N`. PraisonAI fixed the issues in versions `4.5.115` and `4.5.128`, with GitHub advisories published as **GHSA-hwg5-x759-7wjg** and **GHSA-pv9q-275h-rh7x**.
Jun 29, 2026
PraisonAI, a multi-agent teams platform, disclosed two high-severity vulnerabilities affecting versions before **4.5.97** and **4.5.90**. The more severe issue, tracked as `CVE-2026-34953`, stems from `OAuthManager.validate_token()` returning `True` for tokens missing from its internal store, which is empty by default. That logic flaw lets attackers present arbitrary Bearer tokens to authenticate to the MCP server and gain full access to registered tools and agent capabilities. The vulnerability was classified as **CWE-863** with a CVSS v3.1 vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`. A second flaw, `CVE-2026-34934`, exposed PraisonAI to second-order SQL injection through `get_all_user_threads`. In affected versions before **4.5.90**, the function constructed raw SQL queries with Python f-strings using unescaped thread IDs previously stored in the database, allowing an attacker to plant a malicious thread ID via `update_thread` and trigger injection when thread lists were loaded. The bug could lead to full database compromise and was classified as **CWE-89** with a CVSS v3.1 vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`; both issues were addressed in patched releases published through GitHub Security Advisories.
Jun 29, 2026