CVE-2026-62176

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.78

Description The deploy/api.py module generates Python server code by directly interpolating the agents file parameter into an f-string, which is subsequently written to a file and executed using subprocess.Popen(). Because the agents file variable is not sanitized or validated, an attacker who controls this value via CLI arguments, configuration, or an upstream API can inject and execute arbitrary Python code on the machine running the deploy command. A similar issue exists in the deploy/docker.py module during Dockerfile generation.

Recommendations Update to version 4.6.78. Restrict access to the deploy/api.py and deploy/docker.py modules to minimize the risk of exploitation.