Vulnerability Description
PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Python source code for API servers. Attackers can inject arbitrary Python expressions through the deploy.api.host and agents_file configuration parameters that execute when the generated server starts or handles requests.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/MervinPraison/PraisonAI/commit/1620b49f36945d8cc8ee5635b906c9
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-79fv-7hq9-w7
- https://www.vulncheck.com/advisories/praisonai-before-code-injection-via-api-dep
FAQ
What is CVE-2026-61433?
CVE-2026-61433 is a vulnerability with a CVSS score of 7.8 (HIGH). PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Python source code for API servers. Attackers can inject arbitrary Python expressions through the deploy....
How severe is CVE-2026-61433?
CVE-2026-61433 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-61433?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.