CVE-2026-61443 MervinPraison CVE debrief

Who should care

Defenders responsible for PraisonAI deployments should assess exposure and prioritize patching to prevent potential script execution. They should verify the presence of vulnerable PraisonAI versions and apply patches to prevent potential script execution. Additionally, defenders should review and restrict the use of SkillTools to prevent arbitrary script execution and implement additional security measures to monitor and control script execution.

Why it matters

CVE-2026-61443 allows for potential arbitrary script execution in PraisonAI SkillTools, requiring defenders to verify and patch vulnerable versions.

• Potential arbitrary script execution via LLM-directed calls
• Bypass of the `@require_approval` decorator via YAML `approve:` for high-risk tools
• Lateral movement and exploitation of adjacent systems
• Data tampering and unauthorized access

Technical summary

The `SkillTools.run_skill_script()` function in PraisonAI accepts a `script_path` parameter and executes it via `subprocess.run()` without any path containment validation, potentially allowing arbitrary script execution. The function does not perform any path traversal checks or containment validation, unlike `FileTools._validate_path()`, which properly validates that the resolved path stays within the working directory. This vulnerability affects PraisonAI deployments, which defenders should assess for exposure and prioritize patching to prevent potential script execution.

Defensive priority

Defenders should prioritize verifying the presence of vulnerable PraisonAI versions and applying patches to prevent potential script execution.

Recommended defensive actions

• Verify the version of PraisonAI and upgrade to a patched version if necessary
• Review and restrict the use of SkillTools to prevent arbitrary script execution
• Implement additional security measures to monitor and control script execution
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The source corpus provides details on the vulnerability in PraisonAI's SkillTools, including code snippets and affected versions. The vulnerability allows for potential arbitrary script execution via LLM-directed calls and bypass of the `@require_approval` decorator via YAML `approve:` for high-risk tools. Defenders should verify the presence of vulnerable PraisonAI versions and apply patches to prevent potential script execution. The source corpus also notes that the vulnerability affects PraisonAI deployments, which defenders should

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.