PraisonAI's AICoder agent let prompt-injected chat messages write files and run shell commands as root, in a batch of 19 disclosed flaws

PraisonAI (MervinPraison/PraisonAI) users·PraisonAI (AICoder UI agent and Platform API)Fixed

PraisonAI's AICoder chat-UI component exposed `write_to_file` and `execute_command` as LLM tool calls with no path validation or command sanitization, so a prompt-injected chat message could make the agent write to arbitrary filesystem paths (e.g. /root/.ssh/authorized_keys, /etc/crontab) and execute arbitrary shell commands as root inside its Docker container; the same Oct 8, 2026 batch of 19 PraisonAI advisories also disclosed an unauthenticated MCP HTTP-stream tool-call surface, an unauthenticated Jobs API exposing attacker-controlled webhook SSRF, a Platform API authorization bypass letting an ordinary workspace member reassign and then delete owner-owned projects/issues/agents, a shell command allowlist bypass via `find -exec`, and a prompt-injection filter that only blocks an input when 3 or more detector families fire simultaneously.

Blast radius

No named victim deployment; impact is demonstrated via researcher proof-of-concept against the affected published packages (pip praisonai <=4.6.77, pip praisonai-platform <=0.1.8). The AICoder flaw (CVE-2026-61445) scored CVSS 9.9 (full confidentiality/integrity/availability loss, scope changed) and gives root-level arbitrary file write and command execution to anyone who can inject a chat message; the Platform authorization bypass (CVE-2026-61442) scored CVSS 7.1 and lets any workspace member overwrite or delete owner-created project, issue and agent records.

Root cause

LLM tool-call outputs (file paths, shell command strings, API payload fields) were passed directly into filesystem writes, subprocess execution, and record-update logic without the same path/command sanitization or owner/admin authorization checks that the equivalent delete or read paths already enforced.

How it was caught

Found and reported by an external security researcher (credited as 'rexpository'), who built and published working proof-of-concept exploits against the open-source repository and the released pip packages; the flaws were not caught by PraisonAI's own testing before disclosure.

What changed

The AICoder arbitrary file write/command execution flaw (CVE-2026-61445) is patched in praisonai 4.6.78. The Platform PATCH authorization bypass (CVE-2026-61442) had no fixed version or fix commit at the time GitHub reviewed and published the advisory on Oct 8, 2026; GitHub's advisory notes several related same-class authorization issues are tracked separately across the 19-advisory batch.

Take-awayNever let an LLM's raw tool-call arguments reach a filesystem write, subprocess call, or an authorization-checked API route without applying the same path/command validation and ownership check that the equivalent delete or read path already enforces.