CVE Watch15 jul 2026

CVE-2026-61438

PraisonAI before 4.6.78 contains a remote code execution vulnerability in JobWorkflowExecutor._exec_inline_python() due to insufficient AST

CVSS

7.3

Alto

EPSS

0.2%

p10

KEV

—

Exploit Today

0-100

Publicado: 15 jul 2026 · Última mod.: 15 jul 2026 · CWE-78

EPSS · 30d

0.2%EPSS · 30 días0.2%

2026-07-162026-07-17

Descripción técnica

PraisonAI before 4.6.78 contains a remote code execution vulnerability in JobWorkflowExecutor._exec_inline_python() due to insufficient AST validation of workflow script steps. Attackers can create malicious YAML workflow files with import os statements followed by os.system() calls that bypass sandbox checks and execute arbitrary OS commands with process privileges.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-341978.8 ALT

99.9%

KEV—80Apache ActiveMQ Improper Input Validation Vulnerability3d CVE-2024-121210.0 CRÍ

99.9%

KEV—80Progress Kemp LoadMaster OS Command Injection Vulnerability5d CVE-2026-398089.8 CRÍ

99.7%

KEV—80Fortinet FortiSandbox OS Command Injection Vulnerability1d CVE-2022-262589.8 CRÍ

99.6%

KEV—80D-Link DIR-820L Remote Code Execution Vulnerability9d CVE-2026-422718.8 ALT

99.6%

KEV—80BerriAI LiteLLM Command Injection Vulnerability3d CVE-2021-252988.8 ALT

99.5%

KEV—80Nagios XI OS Command Injection9d