CVE-2026-61446

Name of the Vulnerable Software and Affected Versions PraisonAI (praisonaiagents) versions prior to 1.6.78

Description A remote code execution issue exists in the plugin manager. The system loads and executes arbitrary Python (.py) files from project-level and user-home .praisonai/plugins/ directories using the spec from file location() and exec module() functions. This process occurs without code signing, integrity verification, or sandboxing. An attacker capable of writing a malicious .py file to a plugin directory—potentially through path traversal, a supply chain attack, or a compromised dependency—can achieve arbitrary code execution during the plugin system initialization.

Recommendations Update PraisonAI (praisonaiagents) to version 1.6.78 or later.