CVE-2026-62176: PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation

October 7, 2026

The deploy/api.py module generates Python server code by directly interpolating the agents_file parameter into an f-string that is then written to a file and executed via subprocess.Popen(). An attacker who controls the agents_file value (via CLI argument, configuration, or upstream API) can inject arbitrary Python code.

References

github.com/MervinPraison/PraisonAI/security/advisories/GHSA-g6j7-pffp-8whg
github.com/advisories/GHSA-g6j7-pffp-8whg
nvd.nist.gov/vuln/detail/CVE-2026-62176

Code Behaviors & Features

Detect and mitigate CVE-2026-62176 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →