MEDIUM 5.3 GitHub
CVE-2026-60086
PraisonAI: Prompt-injection defense blocks only when 3+ detector families fire simultaneously; realistic single-vector injections pass through unblocked
## Summary
PraisonAI's opt-in prompt-injection defense (`enable_injection_defense()`) only blocks at `ThreatLevel.CRITICAL`, which requires three or more distinct detector families to match simultaneously. A realistic single- or double-vector prompt injection (e.g. "Ignore all previous instructions…") is classified `HIGH` and passes through unmodified. The documented `HIGH` "sanitize" behavior is not implemented.
## Root cause
`scan_text` sets `blocked = (level >= ThreatLevel.CRITICAL) and no
Affected Products
- pip/praisonai <= 4.6.77
References
- https://github.com/advisories/GHSA-4r3p-w3mc-5v34
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4r3p-w3mc-5v34
- https://nvd.nist.gov/vuln/detail/CVE-2026-60086
- https://www.vulncheck.com/advisories/praisonai-before-prompt-injection-defense-bypass
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-10-08 via GitHub. Affected: pip/praisonai <= 4.6.77.
vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.