PraisonAI before 4

PraisonAI is an open-source multi-agent LLM framework. Its AICoder component exposes tool calls the LLM can invoke on the host: writing files, executing shell commands, editing code. The 4.6.78 fix closes two holes in that tool layer — the file-write handler never validated paths (classic ../../ traversal, CWE-22), and the shell-exec handler never sanitized arguments. A crafted prompt fed through the chat UI reaches the tool dispatcher and lands as an arbitrary write anywhere the process can reach, or a shell command running as the PraisonAI process user — which in the reference Docker image is root. Affected: all versions < 4.6.78; fixed in 4.6.78.

The vendor's 9.9 CRITICAL with PR:L / S:C is technically defensible — the LLM chat endpoint often requires only a login token, and the scope change models the jump from the LLM sandbox to the host filesystem. But 9.9 assumes the target is a production-role internet-facing service, and PraisonAI overwhelmingly isn't. It shows up as a developer sandbox, a research notebook, or a bolted-on internal assistant. The mechanic is real; the exposed population is narrow. HIGH is honest; CRITICAL over-signals it against a patch queue that already has FortiGate and vCenter items in front of it.

Why this verdict

• Trivial exploitation: unsanitized path + shell=True reachable from a chat prompt. No memory corruption, no timing, no auth-bypass chain required.
• Friction — auth token: PR:L means a session/token is normally needed. In enterprise deployments this is real friction; in dev sandboxes it is not.
• Friction — install base: PraisonAI has an order of magnitude fewer enterprise deployments than Jenkins/GitLab-class targets. Attackers with a working payload will not sweep the internet with it the way they would a Fortinet bug.
• Friction — exposure: Shodan shows ~180 exposed instances globally. Below the threshold where opportunistic scanning is economical.
• Role multiplier — dev sandbox (majority case): chain succeeds, blast radius is one workstation or one container. LOW impact per host.
• Role multiplier — internal AI assistant with connected tools (typical case): chain succeeds, blast radius includes any API keys, GitHub PATs, and Slack tokens in the process env. HIGH impact — this is why the verdict floor is HIGH, not MEDIUM.
• Role multiplier — CI/CD-embedded coding agent (edge case, growing): chain succeeds, agent has repo push and pipeline-trigger rights, outcome is supply-chain pivot. This is the reason the verdict does not sink lower even with thin install base.

Why not higher?

CRITICAL is reserved for chains that are both trivial AND widely exposed AND land in canonical high-value roles by default. PraisonAI meets 'trivial' but fails 'widely exposed' (sub-1000-host global exposure) and only sometimes lands in a supply-chain-adjacent role. No KEV, no observed campaigns, no mass-scan activity.

Why not lower?

MEDIUM would require the chain to break in typical deployments or the impact to cap at the affected host. Neither holds: the exploit works out of the box against a stock Docker image, secrets in process env are the norm for LLM frameworks, and CI/CD-embedded deployments make the role-multiplier floor HIGH.

1. Front-end PraisonAI with an authenticating reverse proxy today — Put oauth2-proxy, Cloudflare Access, or Tailscale in front of every PraisonAI listener. This kills the PR:L step for unauthenticated internal deployments. Deploy within 30 days per the noisgate mitigation SLA for HIGH — but if the instance is internet-reachable, do it today.
2. Disable the AICoder file-write and shell-exec tools in agents.yaml — For deployments that only need retrieval / summarization agents, comment out the AICoder tool registration. Removes the vulnerable code path entirely. Fastest control — ship in the next config push.
3. Run PraisonAI in a read-only container with a seccomp profile — --read-only blocks the file-write variant; a seccomp profile denying execve blocks the RCE variant. Combine with --user 1000:1000 so a container break doesn't hit root. Roll out within 30 days.
4. Move all secrets out of the process env into short-lived vault tokens — Even a successful RCE should not yield reusable OpenAI keys and GitHub PATs. Bind Vault agent to the pod with a 15-minute TTL. Blunts the pivot step for this CVE and future ones.
5. Add a Falco / auditd rule for execve from a python* parent under the PraisonAI cgroup — High-signal detection for exploitation attempts against unpatched instances during the mitigation window.

Run on the target Linux host or inside the PraisonAI container. Invoke as ./check-cve-2026-61445.sh — no root required, it just reads the installed package metadata and Docker image digest. Exits 0 for PATCHED, 1 for VULNERABLE, 2 for UNKNOWN.

#!/usr/bin/env bash
# noisgate check for CVE-2026-61445 (PraisonAI AICoder path traversal + RCE)
# Verdict: PATCHED if praisonai >= 4.6.78, VULNERABLE if < 4.6.78, UNKNOWN otherwise.
set -u

FIXED="4.6.78"
STATUS="UNKNOWN"
DETECTED=""

ver_ge() {
  # returns 0 if $1 >= $2 using natural version sort
  [ "$(printf '%s\n%s\n' "$2" "$1" | sort -V | head -n1)" = "$2" ]
}

# 1. pip-installed
if command -v python3 >/dev/null 2>&1; then
  V=$(python3 -c "import importlib.metadata as m; print(m.version('praisonai'))" 2>/dev/null || true)
  if [ -n "$V" ]; then
    DETECTED="pip:$V"
    if ver_ge "$V" "$FIXED"; then STATUS="PATCHED"; else STATUS="VULNERABLE"; fi
  fi
fi

# 2. Docker image tag (if we are on a docker host)
if command -v docker >/dev/null 2>&1; then
  IMG=$(docker ps --format '{{.Image}}' | grep -i praisonai | head -n1 || true)
  if [ -n "$IMG" ]; then
    TAG="${IMG##*:}"
    DETECTED="${DETECTED:+$DETECTED,}docker:$TAG"
    if [ "$TAG" != "latest" ] && ver_ge "$TAG" "$FIXED"; then
      [ "$STATUS" = "UNKNOWN" ] && STATUS="PATCHED"
    elif [ "$TAG" = "latest" ]; then
      : # cannot decide from tag alone
    else
      STATUS="VULNERABLE"
    fi
  fi
fi

echo "CVE-2026-61445 status: $STATUS  (detected: ${DETECTED:-none})"
case "$STATUS" in
  PATCHED)    exit 0 ;;
  VULNERABLE) exit 1 ;;
  *)          exit 2 ;;
esac

Sources

1. TheHackerWire — PraisonAI AICoder Critical RCE & Arbitrary File Write
2. THREATINT — CVE-2026-61445 record
3. DailyCVE — PraisonAI Path Traversal GHSA-4ph2-f6pf-79wv
4. DailyCVE — PraisonAI Agents Path Traversal
5. Endor Labs — related PraisonAI MCP traversal (CVE-2026-44336)
6. PraisonAI GitHub project (release history and advisories)
7. CISA KEV catalog (for currency check)
8. FIRST EPSS lookup