CVE-2026-61447 and CVE-2026-61445: PraisonAI ran LLM-written code and commands with no sandbox
Two PraisonAI advisories: CodeAgent ran model-generated Python with the full environment (every API key and credential) and ignored sandbox=True, and the AICoder UI let the model write any file and run any command. Prompt injection turns either one into code execution.
What it is
CVE-2026-61447 (praisonaiagents): CodeAgent._execute_python() wrote LLM-generated code to a temp file and ran it with os.environ.copy(), with no AST checks or import limits. CodeConfig(sandbox=True) existed but was never checked.
That means text the agent reads (user input, tool results, ingested pages) can steer it into exfiltrating OPENAI_API_KEY, DATABASE_URL, cloud tokens and anything else in the environment, or running arbitrary code.
CVE-2026-61445 (praisonai): the AICoder component gave the model write_to_file and execute_command tools with no path checks or command filtering, so a chat message could get it to write files such as /etc/cron.d entries or run shell commands. The advisory notes the Docker images run as root.
How to check
- Affected: praisonaiagents (pip) <= 1.6.77 and praisonai (pip) <= 4.6.77.
- Check whether you use CodeAgent or the AICoder UI, and what secrets are in that process's environment.
How to fix
- Upgrade praisonaiagents to 1.6.78 or later and praisonai to 4.6.78 or later.
- Run agents that execute code in a separate container without your real credentials, and not as root.
pip show praisonai praisonaiagents | grep -E 'Name|Version'