CVE-2026-61445
PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls
The AICoder UI component exposes write_to_file and execute_command tools to the LLM with no path validation and no command sanitization. An attacker can achieve arbitrary file write to any location on the filesystem (including /root/.ssh/authorized_keys, /etc/crontab) and arbitrary command execution through prompt injection in the chat interface. Docker containers run as root, maximizing impact.
- No known exploitation
- Severity
- Critical, CVSS 9.9 (v3.1)
- EPSS
- 0.88% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- praisonai (pip) <= 4.6.77, fixed in 4.6.78 · GHSA-9mp3-24cc-77mg