[ CVE-2026-61434 · Published 10 Jul 2026 ]
PraisonAI: Shell command allowlist bypass via find -exec built-in action
CVSS 8.8
EPSS <1%Fix available
[ Why it matters ]Priority signals
- Public proof-of-concept exploit exists (CISA SSVC)
[ Description ]Official description
PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell command execution that allows attackers to execute restricted commands via find's built-in -exec, -execdir, and -delete actions. Attackers can craft find commands with these built-in actions to read blocked files, delete files, or execute non-allowlisted binaries without triggering shell metacharacter filters.
[ Fixes ]Fixes and patches
- praisonai 4.6.78Fixed version · GitHub Advisories · pip package praisonai: upgrade to 4.6.78 or later (affected <= 4.6.77)
[ Packages ]Affected open-source packages
- praisonai pipAffected <= 4.6.77 · fixed in 4.6.78 · GHSA-cv3g-hj65-pcfh