CVE-2026-61433

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.78

Description The software fails to safely encode deployment configuration values during the generation of Python source code for API servers. This allows attackers to inject arbitrary Python expressions via the deploy.api.host and agents file configuration parameters, which are then executed when the generated server starts or processes requests.

Recommendations Update PraisonAI to version 4.6.78 or later. Avoid using the deploy.api.host and agents file parameters with untrusted input until the update is applied.