What is GHSA-vwv5-32vr-3jcp?

GHSA-vwv5-32vr-3jcp is a security advisory published by GitHub Security Advisories with Critical severity. PraisonAI versions before 4.6.78 contain a code injection vulnerability in deploy/api.py where...

Which CVE IDs does GHSA-vwv5-32vr-3jcp cover?

GHSA-vwv5-32vr-3jcp covers the following CVE IDs: CVE-2026-61444. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vwv5-32vr-3jcp?

GHSA-vwv5-32vr-3jcp has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

GHSA-vwv5-32vr-3jcpCriticalCVSS 9.1

PraisonAI versions before 4.6.78 contain a code injection vulnerability in deploy/api.py where...

Vendor

GitHub Security Advisories

Published

July 10, 2026

Last Modified

July 10, 2026

🔗 CVE IDs covered (1)

CVE-2026-61444 →

📋 Description

PraisonAI versions before 4.6.78 contain a code injection vulnerability in deploy/api.py where the agents_file parameter is directly interpolated into an f-string without sanitization. Attackers can inject arbitrary Python code that executes when the generated server code runs via subprocess.Popen().

🔗 References (4)

https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-g6j7-pffp-8whg
https://nvd.nist.gov/vuln/detail/CVE-2026-61444
https://www.vulncheck.com/advisories/praisonai-before-code-injection-via-f-string
https://github.com/advisories/GHSA-vwv5-32vr-3jcp