CVE-2026-61443: PraisonAI: SkillTools Executes Scripts Without Path Containment Validation

October 8, 2026

SkillTools.run_skill_script() accepts a script_path parameter and executes it via subprocess.run() without any path containment validation. While FileTools has _validate_path() with traversal detection, SkillTools performs none. An LLM-directed call can execute arbitrary scripts from any filesystem location. The @require_approval decorator can be bypassed via YAML approve: for high-risk tools.

References

github.com/MervinPraison/PraisonAI/security/advisories/GHSA-c44f-37qr-gw3f
github.com/advisories/GHSA-c44f-37qr-gw3f
nvd.nist.gov/vuln/detail/CVE-2026-61443
nvd.nist.gov/vuln/detail/CVE-2026-62168
www.vulncheck.com/advisories/praisonai-before-remote-code-execution-via-skilltools

Code Behaviors & Features

Detect and mitigate CVE-2026-61443 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →