What is GHSA-f352-4x87-wmjh?

GHSA-f352-4x87-wmjh is a security advisory published by GitHub Security Advisories with High severity. PraisonAI before 1.6.78 contains a remote code execution vulnerability in SkillTools...

Which CVE IDs does GHSA-f352-4x87-wmjh cover?

GHSA-f352-4x87-wmjh covers the following CVE IDs: CVE-2026-61443. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-f352-4x87-wmjh?

GHSA-f352-4x87-wmjh has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

GHSA-f352-4x87-wmjhHighCVSS 8.1

PraisonAI before 1.6.78 contains a remote code execution vulnerability in SkillTools...

Vendor

GitHub Security Advisories

Published

July 15, 2026

Last Modified

July 15, 2026

🔗 CVE IDs covered (1)

CVE-2026-61443 →

📋 Description

PraisonAI before 1.6.78 contains a remote code execution vulnerability in SkillTools.run_skill_script() that executes scripts without path containment validation. Attackers can supply absolute file paths to execute arbitrary scripts from any filesystem location, including those outside the intended working directory.

🔗 References (4)

https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-c44f-37qr-gw3f
https://nvd.nist.gov/vuln/detail/CVE-2026-61443
https://www.vulncheck.com/advisories/praisonai-before-remote-code-execution-via-skilltools
https://github.com/advisories/GHSA-f352-4x87-wmjh