CVE-2026-61447: PraisonAI Agents Exposes Secrets via Broken Sandbox in v1.6.77

A critical vulnerability in the PraisonAI Agents Python package allows attackers to extract sensitive credentials and execute arbitrary code on host systems. The flaw, identified as CVE-2026-61447, stems from a fundamental breakdown in the library’s code execution sandbox, which fails to isolate LLM-generated scripts from the host environment.

The risk

The vulnerability exists within the `CodeAgent._execute_python()` function in the `praisonaiagents` package. When this function processes code generated by a large language model, it writes the code to a temporary file and executes it in a subprocess. According to the GitHub Security Advisory GHSA-2xv2-w8cq-5gxw, this process uses `os.environ.copy()` to pass the complete environment of the parent process to the subprocess.

This design choice means that every environment variable available to the main application—including `OPENAI_API_KEY`, `DATABASE_URL`, and AWS credentials—is accessible to the executed code. The advisory notes that this occurs even when developers explicitly set `CodeConfig(sandbox=True)`, rendering the sandbox setting ineffective.

Furthermore, the function performs no validation on the code string before execution. There is no Abstract Syntax Tree (AST) validation, no restriction on imported modules, and no blocking of built-in functions. This lack of sanitization allows an attacker who can influence the LLM’s output—through prompt injection in agent inputs, tool results, or ingested content—to inject malicious Python code. This code can then read and exfiltrate all environment secrets or perform other arbitrary actions on the host system.

By contrast, the advisory highlights that the sandboxed `execute_code` tool in `python_tools.py` correctly uses an empty environment (`env={}`), demonstrating that secure execution patterns exist within the codebase but were not applied to the vulnerable function.

Who is exposed

Developers using the `praisonaiagents` package via pip are affected if they are running version 1.6.77 or earlier. The vulnerability is present in the core code execution logic, meaning any application utilizing the `CodeAgent` with LLM-generated Python code is potentially at risk.

Cost and compliance

The GitHub advisory rates the severity of CVE-2026-61447 as critical. Successful exploitation leads to full environment secret exfiltration, which can result in unauthorized access to cloud infrastructure, databases, and third-party services.

What should you do?

Update the `praisonaiagents` package to version 1.6.78 or later, as this version contains the patch for the vulnerability. If immediate updating is not possible, audit your application to ensure that no LLM-generated code is being executed with access to sensitive environment variables, and consider implementing additional runtime protections.

What to do and how to stay safe: PraisonAI

• Zero-day status depends on vendor awareness, not the age of the code.
• No patch exists initially, so traditional signature-based defenses often fail.
• Mitigation requires reducing the attack surface and isolating critical assets.

Zero-day vulnerabilities exploit unknown flaws, rendering traditional signature-based defenses ineffective during the initial attack window. Reduce risk by maintaining a strict asset inventory, enforcing least privilege, and monitoring for behavioral anomalies.

Step-by-step guide: Zero-Day Vulnerabilities Meaning: How Unpatched Flaws Bypass Your Defenses

General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does setting sandbox=True protect against CVE-2026-61447?

No, the advisory states that the sandbox setting is ineffective because the underlying function still passes the full parent environment to the subprocess.

How can an attacker exploit this vulnerability?

An attacker can influence LLM output via prompt injection in agent inputs, tool results, or ingested content to inject malicious Python code that exfiltrates environment variables.

Is there a fix for CVE-2026-61447?

Yes, the vulnerability is patched in version 1.6.78 of the praisonaiagents package.