CVE Dashboard
Back to Dashboard

CVE-2026-61445

Published: July 11, 2026•Last Modified: July 11, 2026
CVSS SCORE
9.9
CRITICAL

Vulnerability Description

PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component due to missing path validation and command sanitization in LLM tool calls. Attackers can inject malicious prompts through the chat interface to write files to arbitrary filesystem locations and execute arbitrary shell commands with root privileges.

Affected Products & Versions

No configurations parsed from local entry.

Security Advisories & References

Mitigation & Remediation

Update the affected packages to a secure version. Refer to vendor security advisories.

Share Advisory

Copy the standardized markdown formatted vulnerability report to post in Slack, Teams, email, or ticketing systems.

# CRITICAL - CVE-2026-61445 ## EFFECT PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component due to missing path validation and command sanitization in LLM tool calls. Attackers can inject malicious prompts through the chat interface to write files to arbitrary filesystem locations and execute arbitrary shell commands with root privileges. ## AFFECTED Unknown products ## LINKS - [github.com](https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-9mp3-24cc-77mg) - [www.vulncheck.com](https://www.vulncheck.com/advisories/praisonai-before-arbitrary-file-write-and-command-execution) ## SOLUTION - Update the affected packages to a secure version. Refer to vendor security advisories.