CVE-2026-60086: PraisonAI Vulnerability in Prompt-Injection Defense Mechanism
Summary
CVE-2026-60086: PraisonAI's opt-in prompt-injection defense (enable_injection_defense()) only blocks at ThreatLevel.CRITICAL, which requires three or more distinct detector families to match simultaneously. Affects praisonai versions < 4.6.78. Fixed in 4.6.78. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PraisonAI is an open-source AI tool designed for natural language processing tasks, including text generation and conversation simulation. It incorporates a prompt-injection defense mechanism to protect against malicious input. However, this defense is flawed, as it only activates under specific conditions, leaving the system vulnerable to certain types of prompt injections.
Vulnerability Detail
The vulnerability in PraisonAI arises from its prompt-injection defense function, which only blocks potentially harmful inputs when three or more distinct detector families trigger simultaneously. This means that single or double-vector prompt injections can bypass the defense entirely, allowing attackers to manipulate the AI's behavior without detection. The root cause lies in the implementation of the scan_text function, which only sets the blocked status to true at a ThreatLevel.CRITICAL. As a result, realistic prompt injections classified as HIGH are not sanitized or blocked, posing a significant risk to the integrity of the AI's responses.
How To Fix
Latest published version: 4.7.16 as of 22 Oct 2026
pip install --upgrade "praisonai==4.7.16"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.6.78
This is the first release that contains the fix.
pip install --upgrade "praisonai==4.6.78"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no effective workarounds to mitigate this vulnerability without updating to the patched version. It is recommended to avoid using the vulnerable version of PraisonAI until the update is applied.
Conclusion
The PraisonAI vulnerability (CVE-2026-60086) highlights significant flaws in its prompt-injection defense mechanism, allowing malicious inputs to bypass security measures. Users are strongly encouraged to update to the latest version to mitigate risks associated with this vulnerability.
See every vulnerability recorded for praisonai →
FAQ
The vulnerability allows certain prompt injections to bypass the defense mechanism, which only activates under specific conditions, leaving the system exposed.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 5.3, indicating a moderate level of risk.
If you cannot update immediately, it is advisable to limit the use of PraisonAI in sensitive applications until the vulnerability is patched.
The 'sanitize' behavior is supposed to modify the input text to prevent harmful instructions from being executed, but it is not currently implemented for HIGH threat levels.
Related vulnerabilities
Recent vulnerabilities recorded for praisonai.
