CVE-2026-61445 — PraisonAI before 4.6.78 Arbitrary File Write and Command Execution
PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component due to missing path validation and command sanitization in L…
Published: 2026-07-11 · CVSS: 9.4 · CVSS 4.0
PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component due to missing path validation and command sanitization in LLM tool calls. Attackers can inject malicious prompts through the chat interface to write files to arbitrary filesystem locations and execute arbitrary shell commands with root privileges.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7