CVE-2026-61447
CRITICAL
NVD
CVSS Score
10
Severity
CRITICAL
Published
Jul 11, 2026
Vendor
unknown
Description
PraisonAI before 1.6.78 contains a remote code execution vulnerability in CodeAgent._execute_python() that executes LLM-generated Python code without AST validation, import restrictions, or sandbox enforcement. Attackers can influence LLM output through prompt injection to exfiltrate all environment secrets and execute arbitrary code on the host system.