CVE-2026-61445: PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls

October 8, 2026

The AICoder UI component exposes write_to_file and execute_command tools to the LLM with no path validation and no command sanitization. An attacker can achieve arbitrary file write to any location on the filesystem (including /root/.ssh/authorized_keys, /etc/crontab) and arbitrary command execution through prompt injection in the chat interface. Docker containers run as root, maximizing impact.

References

github.com/MervinPraison/PraisonAI/security/advisories/GHSA-9mp3-24cc-77mg
github.com/advisories/GHSA-9mp3-24cc-77mg
nvd.nist.gov/vuln/detail/CVE-2026-61445
www.vulncheck.com/advisories/praisonai-before-arbitrary-file-write-and-command-execution

Code Behaviors & Features

Detect and mitigate CVE-2026-61445 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →