CVE-2026-62176
PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation
The deploy/api.py module generates Python server code by directly interpolating the agents_file parameter into an f-string that is then written to a file and executed via subprocess.Popen(). An attacker who controls the agents_file value (via CLI argument, configuration, or upstream API) can inject arbitrary Python code.
- No known exploitation
- Severity
- Critical, CVSS 9.1 (v3.1)
- EPSS
- 0.46% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- PraisonAI (pip) <= 4.6.77, fixed in 4.6.78 · GHSA-g6j7-pffp-8whg