exploit · Wed 07 Oct 2026 · 16:05 UTC
GHSA-g6j7-pffp-8whg: PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation
Filed UTCSource GTH ↗
The deploy/api.py module generates Python server code by directly interpolating the agents_file parameter into an f-string that is then written to a file and executed via subprocess.Popen(). An attacker who controls the agents_file value (via CLI argument, configuration, or upstream API) can inject arbitrary Python code. ### Details src/praisonai/praisonai/deploy/api.py (line 80): ```python code = f'''... praisonai = PraisonAI(agent_file="{agents_file}") ... "agent_file": "{agents_file}" ... …
Signals
as the pipeline stamped them- High
- Critical vulnerability — CVSS 9.1
- What to do
- Critical severity — schedule an urgent patch.
CVE
KEV from CISA · EPSS from FIRST| Id | KEV | EPSS | Reference |
|---|---|---|---|
| CVE-2026-62176 | — | 0.46% | NVD ↗ |
Get the next one first.
Every dispatch goes to Telegram and RSS the moment it is published, and the whole wire is a keyless JSON API.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.