PraisonAI before 4.6.78 Code Injection via API deployment generator (MervinPraison PraisonAI)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.21 % · percentile 11 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- VulnCheck
- NVD status
- Deferred
Description
PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Python source code for API servers. Attackers can inject arbitrary Python expressions through the deploy.api.host and agents_file configuration parameters that execute when the generated server starts or handles requests.
Weaknesses (CWE)
- CWE-94 — Improper Control of Generation of Code
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 4.0 | HIGH 8.5 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | VulnCheck |
| CVSS 4.0 | HIGH 8.5 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · disclosure@vulncheck.com (Secondary) |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · disclosure@vulncheck.com (Secondary) |
Advisories
- GHSA-79fv-7hq9-w7xg — PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source
- PYSEC-2026-4251 — PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source
European references
- ENISA EUVD · EUVD-2026-44640
- GCVE · GCVE-0-2026-61433
Affected products
| Product | Versions |
|---|---|
| MervinPraison · PraisonAI | affected 0 < 4.6.78 ; unaffected 4.6.78 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |