CVE Intelligence
Analysis AI-assisted

CVE-2026-62176: PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation

PraisonAI, a multi-agent teams system, builds server code for its deploy API by inserting the agents_file value into an f-string that is written to a file and executed, which enables Python code injection (CWE-94). The record rates it critical with a CVSS score of 9.1 and states that version 4.6.78 fixes the issue. No confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

PraisonAI is a multi-agent teams system. According to the record, the deploy/api.py module builds Python server code by placing the agents_file value directly into an f-string, writes the result to a file and runs it with subprocess.Popen(). This is classified as code injection (CWE-94).

Impact

  • The record describes arbitrary Python code injection when an attacker controls the agents_file value.
  • The CVSS base score is 9.1 (critical), with high confidentiality, integrity and availability impact according to the vector in the record.
  • The vector requires high privileges (PR:H) and a changed scope. This suggests the attacker must already hold some access or influence the input path, which is an inference from the vector.

Affected products and versions

  • Product: MervinPraison PraisonAI.
  • Affected range: versions before 4.6.78.
  • Fixed version: 4.6.78, as stated in the CVE description. The structured fix field in the record is empty, so confirm the details against the advisory.

Exploitation status

  • The CVE is not listed in the CISA KEV catalog (kev.listed is false). No confirmed exploitation in the wild appears in the sources consulted.
  • The SSVC record lists exploitation as poc and automatable as no. This reflects the record's assessment of exploitation maturity, not confirmed attacks.
  • The EPSS probability is 0.0046 (percentile 0.38975) as of 2026-10-23.

Remediation and mitigation

  • Upgrade PraisonAI to 4.6.78 or later.
  • Until the upgrade is applied, restrict who can set agents_file through CLI arguments, configuration files and upstream APIs, and treat that value as untrusted input.
  • Do not expose the deploy API server to untrusted networks.
  • Review generated server files produced by the affected module and remove any you did not expect.

Detection guidance

  • Look for unexpected child processes started by the PraisonAI deploy workflow.
  • Audit recent changes to agents_file values and to the configuration sources that supply them.
  • Monitor deployment directories for newly written Python files whose content does not match your normal workflow.

Limitations of the available information

  • The record does not include detailed technical analysis, proof-of-concept details or the exact conditions under which the input is reachable.
  • The source_status field reads Deferred, and the record does not explain its meaning.
  • Only the GitHub advisory and the NVD and CVE.org pages were consulted. Any further details are unknown.

Frequently asked questions

Which versions are affected?

The record lists PraisonAI versions before 4.6.78 as affected. The CVE description states that version 4.6.78 fixes the issue.

Is this vulnerability being actively exploited?

The CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. The SSVC record lists exploitation as poc, which is an assessment of maturity rather than confirmed attacks.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.