critical9.1
CVE-2026-61444
PraisonAI versions before 4.6.78 contain a code injection vulnerability in deploy/api.py where the agents_file parameter is directly interpolated into an f-str…
Impact
PraisonAI versions before 4.6.78 contain a code injection vulnerability in deploy/api.py where the agents_file parameter is directly interpolated into an f-string without sanitization. Attackers can inject arbitrary Python code that executes when the generated server code runs via subprocess.Popen().
Affected products
| Product | Affected versions |
|---|---|
| PraisonAI | before 4.6.78 |
Versions were read from the advisory text. No structured product data has been published for this record yet.