ZDF
Sign inSign up

Vulnerabilities

Security research · CVE-2026-61438

PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox

Published Jul 15, 2026 · catalog updated Oct 29, 2026 · MervinPraison PraisonAI

Last checked Oct 30, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-61438. EPSS is 0.31%. Act only if a listed version of MervinPraison PraisonAI is installed.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.

Same product and reporting

Severity
High7.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.31%
Remediation
Version ranges on file
Affected products
PyPI praisonai · pip praisonai · pypi praisonai · vendor MervinPraison PraisonAI

### Summary JobWorkflowExecutor._exec_inline_python() is designed to safely execute inline Python expressions from YAML workflow script: steps using AST validation. The function claims to block dangerous operations by (a) checking all AST nodes against an allowlist, and (b) providing a __builtins__ whitelist that omits __import__, exec, eval, and open. The sandbox is broken. The module import allowlist (allowed_modules) explicitly includes 'os', and the AST allowlist permits ast.Import, ast.ImportFrom, ast.Call, and ast.Attribute nodes. This means the following malicious workflow script: step passes all AST validation checks and executes without error. Attack Scenario Attacker creates or contributes a YAML workflow file (type: job) with a script: step containing import os; os.system(...). A user or CI pipeline with PRAISONAI_ALLOW_JOB_WORKFLOWS=true executes the workflow via praisonai workflow run malicious.yaml. Arbitrary OS commands execute with the privileges of the calling process. This is particularly dangerous in multi-tenant or CI environments where YAML workflows may originate from untrusted sources (e.g., downloaded templates, shared repositories, AI-generated workflows). ### PoC _Complete instructions, including specific configuration details, to reproduce the vulnerability._ ### Impact Root Cause — Lines 364–372: pythonallowed_modules = {'os', 'datetime', 'time', 'json', 'math', 're', 'collections', 'itertools'} if isinstance(node, ast.Import): for alias in node.names: if alias.name.split('.')[0] not in allowed_modules: return {"ok": False, "error": f"Import of '{alias.name}' not allowed..."} os is trusted because it is commonly used for path operations (os.path, os.getcwd). However, os.system(), os.popen(), os.execvp(), os.spawn*(), and os._exit() are all accessible once the module is imported, none of which are individually blocked. The __builtins__ restriction (blocking __import__) is irrelevant because the code uses a real import statement processed b

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • PyPI praisonai0 → 4.6.78
  • pip praisonai< 4.6.78
  • pypi praisonaiversion unspecified
  • vendor MervinPraison PraisonAIversion unspecified

How to fix CVE-2026-61438

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-61438. EPSS is 0.31%. Act only if a listed version of MervinPraison PraisonAI is installed.

Which versions are affected?

Compare what you have installed with 0 → 4.6.78, < 4.6.78. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-184; CWE-693: Protection Mechanism Failure; CWE-78: OS Command Injection. EPSS 0.31%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 29, 2026 · PyPA Advisory Database

    Detected

    ### Summary JobWorkflowExecutor._exec_inline_python() is designed to safely execute inline Python expressions from YAML workflow script: steps using AST validation. The function claims to block dangerous operations by (a) checking all AST nodes against an allowlist, and (b) providing a __builtins__ whitelist that omits __import__, exec, eval, and open. The sandbox is broken. The module import allo

  2. Oct 29, 2026 · PyPA Advisory Database

    Fix available

    praisonai fixed in 4.6.78

  3. Oct 29, 2026 · PyPA Advisory Database

    Fix available

    praisonai fixed in 4.6.78

  4. Oct 29, 2026 · PyPA Advisory Database

    Updated

    ### Summary JobWorkflowExecutor._exec_inline_python() is designed to safely execute inline Python expressions from YAML workflow script: steps using AST validation. The function claims to block dangerous operations by (a) checking all AST nodes against an allowlist, and (b) providing a __builtins__ whitelist that omits __import__, exec, eval, and open. The sandbox is broken. The module import allo

Sources

  • CVE.orgVulnerability recordCVE-2026-61438

    PraisonAI before 4.6.78 contains a remote code execution vulnerability in JobWorkflowExecutor._exec_inline_python() due to insufficient AST validation of workflow script steps. Attackers can create malicious YAML workflow files with import os statements followed by os.system() ca

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-26mh-57q7-jfvr

    PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-61438

    JobWorkflowExecutor._exec_inline_python() is designed to safely execute inline Python expressions from YAML workflow script: steps using AST validation. The function claims to block dangerous operations by (a) checking all AST nodes against an allowlist, and (b) providing a builtins whitelist that omits import, exec, eval, and open. The sandbox is broken. The module import allowlist (allowed_modul

    advisories.gitlab.com
  • PyPA Advisory DatabasePackage advisoryGHSA-26mh-57q7-jfvr

    PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox

    osv.dev

References

Freshness

Last verified in this catalog Oct 29, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • GitLab Advisory DatabaseOct 30, 2026
  • GitHub Advisory DatabaseOct 30, 2026
  • CVE.orgOct 29, 2026
  • PyPA Advisory DatabaseOct 29, 2026