CVE-2026-61443
Last modified
CVE-2026-61443 is a high-severity vulnerability rated 8.6/10 on the CVSS scale. PraisonAI before 1.6.78 contains a remote code execution vulnerability in SkillTools.run_skill_script() that executes scripts without path containment validation. Attackers can supply absolute file paths to execute arbitrary scripts from any filesystem location, including those outside the intended working directory..
Description
PraisonAI before 1.6.78 contains a remote code execution vulnerability in SkillTools.run_skill_script() that executes scripts without path containment validation. Attackers can supply absolute file paths to execute arbitrary scripts from any filesystem location, including those outside the intended working directory.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| MervinPraison | PraisonAI | < 1.6.78 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-61443?
How severe is CVE-2026-61443?
How do I fix CVE-2026-61443?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-61437PraisonAI (pip package praisonaiagents) before 1.6.78 contai…8.5
- CVE-2026-61438PraisonAI before 4.6.78 contains a remote code execution vul…7.3
- CVE-2026-61439PraisonAI versions before 4.6.78 contain a prompt injection …8.7
- CVE-2026-61440PraisonAI Platform before 0.1.9 fails to properly authorize …7.1
- CVE-2026-61441PraisonAI Platform (praisonai-platform) before 0.1.9 imprope…7.1
- CVE-2026-61442PraisonAI Platform (praisonai-platform) before 0.1.9 fails t…7.1
- CVE-2026-61444PraisonAI versions before 4.6.78 contain a code injection vu…9.4
- CVE-2026-61445PraisonAI before 4.6.78 contains arbitrary file write and co…9.9
- CVE-2026-61446PraisonAI (praisonaiagents) before 1.6.78 contains a remote …8.6
- CVE-2026-61447PraisonAI before 1.6.78 contains a remote code execution vul…10
- CVE-2026-61448Parse Server is affected by a stored cross-site scripting (X…2.1
- CVE-2026-61449Grav 2.0.1 contains a decompression-bomb size-cap bypass in …7.1
Are you affected by CVE-2026-61443?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST