Loading vulnerability…
Prompt injection leading to remote code execution in PraisonAI CodeAgent
CVE-2026-61447 is a remote code execution vulnerability in PraisonAI's praisonaiagents package before version 1.6.78. The CodeAgent._execute_python() method executes LLM-generated Python without AST validation, import restrictions, or enforced sandboxing. The execution subprocess inherits the parent process's environment, exposing secrets even when CodeConfig(sandbox=True) is configured. Attackers who influence generated code through prompt injection in agent inputs, tool results, or ingested content can execute arbitrary code with the CodeAgent process's privileges and exfiltrate accessible environment secrets.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the confidentiality, integrity, and availability of resources accessible to the CodeAgent process. Attacker-controlled code can read and exfiltrate environment variables containing API keys, database credentials, and cloud tokens; access or modify files; initiate network connections; and execute system commands. Depending on process privileges and available credentials, exploitation can lead to host compromise and unauthorized access to connected services.
If you can’t patch tonight, do this now.
Until patched, avoid executing untrusted or LLM-generated Python through the vulnerable CodeAgent functionality. Restrict network exposure and access to untrusted agent inputs, tool results, and ingested content. Isolate execution from sensitive host resources, remove unnecessary environment secrets, and restrict outbound connectivity. Do not rely on CodeConfig(sandbox=True) as an effective security boundary in affected versions. If untrusted input was processed, rotate potentially exposed credentials and audit connected-service logs for unexpected access.
Patch, then assume compromise.
Upgrade the praisonaiagents PyPI package to version 1.6.78 or later.
No validated public exploits yet. Hidden: 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.