Critical RCE in PraisonAI CodeAgent Enables Host Compromise via Prompt Injection

A critical remote code execution flaw, CVE-2026-61447, was disclosed in the PraisonAI AI agent framework, affecting versions before 1.6.78. The vulnerability lies in CodeAgent._execute_python(), which executes LLM-generated Python without AST validation, import restrictions, or sandbox enforcement, allowing attackers to use prompt injection to make the agent run arbitrary code on the host. The issue received the maximum severity rating of CVSS 10.0 under both v3.1 and v4.0.

Successful exploitation can result in full host compromise and theft of sensitive data, including API keys, cloud credentials, database passwords, and other environment secrets, with potential pivoting into connected services. PraisonAI 1.6.78 fixes the issue, and defenders are being urged to upgrade immediately, reduce network exposure, rotate potentially exposed secrets, and monitor for anomalous outbound connections; no confirmed in-the-wild exploitation had been reported at disclosure time.