---
title: "CVE-2026-61445: PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls"
url: https://erroneo.us/security/cve/CVE-2026-61445/
description: "CVE-2026-61445 (praisonai (PyPI)): PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component due…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-07-11
date_modified: 2026-10-08
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-61445"
kev: false
cvss: 9.4
epss: 0.00881
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-61445: PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls

**Signal:** Critical, preconditions apply. Severe if exploited, but exploitation needs conditions that may not apply to you. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- Not in CISA KEV , but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
- EPSS 0.9% , percentile 59: FIRST’s model estimates a 0.9% chance of exploitation activity in the next 30 days, higher than 59% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
- Needs an account (low (any account)). Exposure depends on who can log in.
- Only applies if your dependency tree includes praisonai (PyPI) <= 4.6.77, fixed in 4.6.78 . Check your lockfile, including transitive dependencies.

## What it is

PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component due to missing path validation and command sanitization in LLM tool calls. Attackers can inject malicious prompts through the chat interface to write files to arbitrary filesystem locations and execute arbitrary shell commands with root privileges.

## Affected packages

- PyPI `praisonai` <= 4.6.77 → fixed: 4.6.78

## Affected products (CVE record)

- MervinPraison PraisonAI: < 4.6.78

## Severity

- VulnCheck CVSS 4.0: 9.4 `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`
- VulnCheck CVSS 3.1: 9.9 `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`
- GitHub CVSS 3.1: 9.9 `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation poc , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 0.88% probability of exploitation activity in the next 30 days; percentile 59.

## Sources

- [GitHub Security Advisory (GHSA-9mp3-24cc-77mg)](https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-9mp3-24cc-77mg)
- [GitHub Advisory GHSA-9mp3-24cc-77mg](https://github.com/advisories/GHSA-9mp3-24cc-77mg)
- [CVE.org record CVE-2026-61445](https://www.cve.org/CVERecord?id=CVE-2026-61445)
- [NVD entry CVE-2026-61445](https://nvd.nist.gov/vuln/detail/CVE-2026-61445)
- [VulnCheck Advisory: PraisonAI before 4.6.78 Arbitrary File Write and Command Execution](https://www.vulncheck.com/advisories/praisonai-before-arbitrary-file-write-and-command-execution)

---
Source page: https://erroneo.us/security/cve/CVE-2026-61445/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt