PraisonAI: Code injection via f-string interpolation in Deploy API
Summary
PraisonAI, a multi-agent teams system, builds Python server code in deploy/api.py by inserting the agents_file value into an f-string, then writes the code to a file and runs it with subprocess.Popen(). The value is never validated, so an attacker who can control it (via CLI argument, configuration file or upstream API) can inject arbitrary Python code. The injected code runs as the user who starts the deploy command, which may hold API keys and other secrets. The vendor states the issue is fixed in 4.6.78, but a third-party review disputes that release exists, so the fixed build must be verified. Severity ratings also differ between NVD (9.1) and VulDB (4.3).
Affected
- PraisonAI (pip package praisonai) before 4.6.78 (vendor advisory: <= 4.6.77)
- The same flaw pattern exists in deploy/docker.py (Dockerfile generation)
Fixed in
- Version 4.6.78 according to the vendor advisory (GHSA-g6j7-pffp-8whg)
- Unverified: a third-party review reports no 4.6.78 release on PyPI and a first release above 4.6.77 of 4.6.81. Confirm the fixed build on PyPI or the GitHub commit before rollout.
Workaround
- No vendor-published workaround.
- Analyst recommendation until patched: do not expose the deploy API, and do not let untrusted CLI arguments, configuration files or upstream API data set agents_file.
Exploitation
- A proof of concept is included in the advisory; CISA SSVC lists exploitation as 'poc' and automatable as 'no'.
- Not known to be exploited in the wild; no attacks reported.
Our recommendation
- Inventory all PraisonAI installations (pip and Docker) and check their versions.
- Upgrade to the verified fixed build; do not rely on 4.6.78 until confirmed.
- Check whether the deploy API is listening and restrict network access to it.
- Restrict who can change agent configuration and agents_file values; treat config files and CI/CD inputs as untrusted until patched.
- Monitor deploy hosts for unexpected processes started by Python.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-g6j7-pffp-8whg github.com
- OSV: CVE-2026-62176 osv.dev
- OpenCVE: CVE-2026-62176 app.opencve.io
- VulDB: 415070 vuldb.com
- HOL Guard: CVE-2026-62176 hol.org
- Safeguard.sh: PraisonAI advisories October 2026 safeguard.sh
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:16.
Original description (NVD)
PraisonAI is a multi-agent teams system. Prior to version 4.6.78, the `deploy/api.py` module generates Python server code by directly interpolating the `agents_file` parameter into an f-string that is then written to a file and executed via `subprocess.Popen()`. An attacker who controls the `agents_file` value (via CLI argument, configuration, or upstream API) can inject arbitrary Python code. Version 4.6.78 patches the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.