HIGH 7.8 GitHub
CVE-2026-61433
PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source
# API deploy code generator embeds unescaped YAML fields into Python source
## Summary
PraisonAI's API deployment generator copies `deploy.api.host` from `agents.yaml` directly into generated Python source without safe literal encoding. A malicious PraisonAI project can set that host value to a Python expression splice; when an operator runs the API deploy flow, the generated server source compiles and executes the injected expression at startup. The same generator also embeds `agents_file` di
Affected Products
- pip/praisonai <= 4.6.77
References
- https://github.com/advisories/GHSA-79fv-7hq9-w7xg
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-79fv-7hq9-w7xg
- https://nvd.nist.gov/vuln/detail/CVE-2026-61433
- https://nvd.nist.gov/vuln/detail/CVE-2026-62173
This high severity vulnerability with a CVSS score of 7.8 was published on 2026-10-08 via GitHub. Affected: pip/praisonai <= 4.6.77.
vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.