PraisonAI praisonaiagents 1.6.77 - Remote Code Execution

ExploitDBExploitDB exploitExploitEDB-52639

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that directly instantiates a vulnerable CodeAgent and passes it malicious code to exfiltrate environment secrets, demonstrating remote code execution.

Backdoor review

No backdoor observed in reviewed code

The PoC script demonstrates the claimed CVE-2026-61447 vulnerability by importing the vulnerable CodeAgent and executing a hardcoded payload that reads environment variables. The payload is limited to printing secrets to stdout; no network exfiltration, persistence, or unrelated harmful behavior is present. The script is a straightforward, transparent exploit demonstration with no concealed or deceptive functionality.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagespython
Target softwarePraisonAI praisonaiagents
Attack typesremote code executioninformation disclosure
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script's primary purpose is to exercise the CVE-2026-61447 vulnerability by directly executing attacker-controlled code on the target system. It imports the vulnerable component, crafts a payload to exfiltrate secrets, and executes it, which constitutes an exploit.

exploits/multiple/remote/52639.py:2exploits/multiple/remote/52639.py:18exploits/multiple/remote/52639.py:54-70

Requirements

  • Requires the vulnerable praisonaiagents package (<= 1.6.77) installed.exploits/multiple/remote/52639.py:30-31

Observed behavior

  • Imports and instantiates the vulnerable CodeAgent class.exploits/multiple/remote/52639.py:54-57
  • Defines malicious Python code that imports os and json, then filters and prints environment variables containing keywords like 'KEY', 'SECRET', 'TOKEN', etc.exploits/multiple/remote/52639.py:59-67
  • Executes the malicious code by calling agent.execute(malicious_code).exploits/multiple/remote/52639.py:70
  • Prints the execution result, including stdout, stderr, and return code.exploits/multiple/remote/52639.py:72-75
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Environment Variable Access
os.environThe hardcoded payload reads environment variables containing keywords like KEY, SECRET, TOKEN, PASSWORD, CREDENTIAL, API, AUTH and prints them to stdout. This is the claimed vulnerability demonstration and does not exfiltrate data externally.exploits/multiple/remote/52639.py:60-66
Import
praisonaiagents.agent.code_agent.CodeAgentThe script imports the vulnerable component to trigger the RCE. This is expected for a PoC targeting the stated CVE.exploits/multiple/remote/52639.py:54
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the static content of the provided exploit file; the code was not executed.
  • The exploit's effectiveness depends on the presence of the vulnerable library version and a functional environment, which cannot be verified from the file alone.
  • Only the supplied exploit script text was reviewed; the imported praisonaiagents library and its CodeAgent implementation were not inspected.
  • Binary or non-text content was not present in the evidence.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1