critical vulnerability

PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls

Fix availableCritical · CVSS 9.9EPSS 0.88%

Published Oct 8, 2026 · updated Oct 8, 2026

What to do

Upgrade to a fixed version: praisonai 4.6.78.
Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPIpraisonai

Vulnerable versions: <= 4.6.77
Fixed in: 4.6.78

Check your project: pip show praisonai

Sources

GitHub Advisory GHSA-9mp3-24cc-77mg
NVD CVE-2026-61445

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') · CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

← All critical vulnerabilities