Changes.Watch~ upgrade verdicts ~
Free digest
Securitysshole: password bypass in Alpine’s OpenSSH

critical vulnerability

PraisonAIAgents has an OS Command Injection via shell=True in Memory Hooks Executor (memory/hooks.py)

Fix availableCritical · CVSS 9.3EPSS 0.24%

Published Apr 10, 2026 · updated Nov 8, 2026

What to do

  1. Upgrade to a fixed version: praisonaiagents 1.5.128.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPIpraisonaiagents6,843 downloads/week

Vulnerable versions
<= 1.5.126
Fixed in
1.5.128

Check your project: pip show praisonaiagents

Sources

CWE-78 Improper Neutralization of Special Elements used in an OS Command

← All critical vulnerabilities