CVE-2026-61433 MervinPraison CVE debrief

Who should care

Operators and developers using PraisonAI should assess exposure and verify if their configurations are vulnerable. They should update to version 4.6.78 or later to remediate this issue. Affected operators must review their configurations and prioritize remediation. Security teams should verify that their configurations are not vulnerable and plan for updates or mitigations.

Why it matters

PraisonAI's API deployment generator vulnerability allows code injection via unescaped YAML fields, impacting operators and developers using PraisonAI. Remediation requires updating to version 4.6.78 or later.

• Code injection possible via unescaped YAML fields
• Generated Python source executes injected expressions at startup
• Second injection site exists in route-handler expressions if agent file path is attacker-controlled
• Remediation requires updating to version 4.6.78 or later

Technical summary

The PraisonAI API deployment generator embeds unescaped YAML fields into Python source, allowing for code injection. The generator copies `deploy.api.host` from `agents.yaml` directly into generated Python source without safe literal encoding. This allows for code injection when an operator runs the API deploy flow. The vulnerability is caused by the lack of safe literal encoding when copying `deploy.api.host` from `agents.yaml` into generated Python source. A second injection site exists in route-handler expressions if the agent file path is attacker-controlled.

Defensive priority

Operators and developers using PraisonAI should assess exposure and verify if their configurations are vulnerable. They should update to version 4.6.78 or later to remediate this issue.

Recommended defensive actions

• Update PraisonAI to version 4.6.78 or later
• Verify configurations for vulnerability
• Assess exposure and prioritize remediation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the lack of safe literal encoding when copying `deploy.api.host` from `agents.yaml` into generated Python source. This allows for code injection when an operator runs the API deploy flow.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.