CVE-2026-61447: PraisonAI CodeAgent Executes LLM-Generated Code Without Sandboxing, Exposing Environment Secrets
Summary
CVE-2026-61447: PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets. Affects praisonaiagents versions < 1.6.78. Fixed in 1.6.78. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PraisonAI is a framework that leverages large language models (LLMs) to automate tasks through code execution. The 'praisonaiagents' package allows users to create agents that can execute Python code generated by LLMs. However, it has a critical vulnerability that permits the execution of arbitrary code without proper sandboxing, leading to potential exposure of sensitive environment variables.
Vulnerability Detail
The vulnerability arises from the method CodeAgent._execute_python(), which executes LLM-generated Python code in a subprocess using the complete parent-process environment. This method lacks any form of AST validation, import restrictions, or sandbox enforcement, even when the sandbox option is enabled. As a result, an attacker can manipulate the LLM output through prompt injection, allowing them to exfiltrate sensitive information such as API keys and execute arbitrary code on the host system. Key technical aspects include the use of os.environ.copy() to pass all environment variables to the subprocess and the absence of any validation or restrictions on the executed code.
How To Fix
Latest published version: 1.7.14 as of 22 Oct 2026
pip install --upgrade "praisonaiagents==1.7.14"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.78
This is the first release that contains the fix.
pip install --upgrade "praisonaiagents==1.6.78"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the CodeAgent._execute_python() method until the package is updated. Instead, consider using alternative methods for executing code that include proper sandboxing and validation. For example, you can use the following code snippet to execute code in a more secure manner:
import subprocess
import tempfile
def secure_execute(code: str):
with tempfile.NamedTemporaryFile(mode='w', suffix='.py', delete=False) as f:
f.write(code)
temp_file = f.name
result = subprocess.run(["python", temp_file], capture_output=True, text=True)
return result.stdout
Conclusion
The PraisonAI vulnerability CVE-2026-61447 poses significant risks due to its lack of sandboxing and validation when executing LLM-generated code. Users are strongly advised to update to the patched version of the package and implement secure coding practices to mitigate potential threats.
See every vulnerability recorded for praisonaiagents →
FAQ
CVE-2026-61447 is a vulnerability in the PraisonAI 'praisonaiagents' package that allows execution of unvalidated LLM-generated code, exposing sensitive environment variables.
An attacker can exploit this vulnerability by manipulating the input to the LLM, leading to the execution of arbitrary code and exfiltration of sensitive information.
The impacts include full credential theft, arbitrary code execution, and remote exploitation, as all environment variables are accessible to the executed code.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
If you cannot update the package, avoid using the vulnerable method and implement a temporary workaround that includes proper sandboxing and validation for executing code.
Related vulnerabilities
Recent vulnerabilities recorded for praisonaiagents.
