CVE-2026-61438 PraisonAI before 4.6.78 Remote Code Execution via Broken AST Sandbox
Attackers can execute arbitrary OS commands by bypassing AST sandbox checks in PraisonAI workflow scripts, allowing remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-61438?
CVE-2026-61438 is a high-severity code injection vulnerability in MervinPraison PraisonAI, published on 15 Jul 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
PraisonAI before 4.6.78 contains a remote code execution vulnerability in JobWorkflowExecutor._exec_inline_python() due to insufficient AST validation of workflow script steps. Attackers can create malicious YAML workflow files with import os statements followed by os.system() calls that bypass sandbox checks and execute arbitrary OS commands with process privileges.
Weakness: CWE-78
Which versions are affected by CVE-2026-61438?
2 open source packages ship an affected version, including praisonai.
| Package | Affected | Fixed in |
|---|---|---|
praisonai PyPI | All versions | 4.6.78 |
praisonai PyPI | All versions | 4.6.78 |
How do I fix CVE-2026-61438?
Upgrade praisonai to 4.6.78 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-61438 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-61438 exists.
Sources
Also known as CVE-2026-62248, GHSA-26mh-57q7-jfvr.