Vulnerability Description
PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component due to missing path validation and command sanitization in LLM tool calls. Attackers can inject malicious prompts through the chat interface to write files to arbitrary filesystem locations and execute arbitrary shell commands with root privileges.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-9mp3-24cc-77
- https://www.vulncheck.com/advisories/praisonai-before-arbitrary-file-write-and-c
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-9mp3-24cc-77
FAQ
What is CVE-2026-61445?
CVE-2026-61445 is a vulnerability with a CVSS score of 9.9 (CRITICAL). PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component due to missing path validation and command sanitization in LLM tool calls. Attacker...
How severe is CVE-2026-61445?
CVE-2026-61445 has been rated CRITICAL with a CVSS base score of 9.9/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-61445?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.