PyPI/praisonaiagents CVE-2026-61447: critical 10, EPSS 2.49%

PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets

Action: Upgrade praisonaiagents to 1.6.78 or later.

pip install praisonaiagents==1.6.78

Affected

Fixed versions

Sources

• osv: PYSEC-2026-4266
• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-2xv2-w8cq-5gxw
• https://nvd.nist.gov/vuln/detail/CVE-2026-61447
• https://github.com/MervinPraison/PraisonAI
• https://www.vulncheck.com/advisories/praisonai-before-remote-code-execution-via-codeagent
• https://pypi.org/project/praisonaiagents
• https://github.com/advisories/GHSA-2xv2-w8cq-5gxw

CVE-2026-61447 · published 2026-10-15T10:22:50.038525Z · modified 2026-10-15T14:45:11.730465449Z · JSON