DailyCVE@dailycve
🔴 PraisonAI, Remote Code Execution, #CVE-2026-61446 (High) -DC-Oct2026-2920 https://dailycve.com/praisonai-remote-code-execution-cve-2026-61446-high-dc-oct2026-2920/
0000020
239 followersView on X
CVE-2026-61446
LOWCVSS 8.6 · HIGHSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
PraisonAI (praisonaiagents) before 1.6.78 contains a remote code execution vulnerability in the plugin manager, which loads and executes arbitrary Python (.py) files from project-level and user-home .praisonai/plugins/ directories using importlib spec_from_file_location() and exec_module() without code signing, integrity verification, or sandboxing. An attacker who can write a malicious .py file to a plugin directory (for example via path traversal, a supply chain attack, or a compromised dependency) achieves arbitrary code execution when the plugin system initializes.
0.0/ 10 priority
Sources & remediation
Other references
Weakness type (CWE)
CWE-94
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day