PraisonAI Agents CVE-2026-61447 Allows Full Environment Secret Exfiltration

A critical vulnerability in PraisonAI Agents, identified as CVE-2026-61447, allows attackers to exfiltrate sensitive environment secrets and execute arbitrary code on the host system. The flaw exists in the `CodeAgent._execute_python()` function, which processes Python code generated by large language models without adequate security controls.

The vulnerability stems from how the agent handles subprocess execution. When `CodeAgent._execute_python()` runs, it writes LLM-generated code to a temporary file and executes it via `subprocess.run`. Crucially, the function passes the complete parent-process environment to the subprocess using `os.environ.copy()`. This exposes all environment variables, including API keys, database credentials, and cloud tokens, to the executed code. This behavior occurs even when the `CodeConfig` is explicitly set with `sandbox=True`, rendering the sandbox setting ineffective.

Technical Details

According to the GitHub advisory GHSA-2xv2-w8cq-5gxw, the vulnerability arises from three primary issues in the source code located in `src/praisonai-agents/praisonaiagents/agent/code_agent.py` (lines 253–308). First, the environment leak occurs because `os.environ.copy()` provides the subprocess with every environment variable from the parent process. In contrast, other tools within the same package, such as the sandboxed `execute_code` tool in `python_tools.py`, use an empty environment (`env={}`) to prevent such exposure.

Second, there is no Abstract Syntax Tree (AST) validation. The LLM-generated code string is written directly to a temporary file and executed without any `_validate_code_ast()` calls, import blocking, or builtin restrictions. This lack of validation allows arbitrary Python code to run unchecked.

Third, the `sandbox=True` configuration parameter is effectively ignored in this context. Attackers who can influence LLM output—through prompt injection in agent input, tool results, or ingested content—can craft malicious prompts that result in the generation of Python code designed to read environment variables and transmit them to an external server.

Who Is Affected

The vulnerability affects users of PraisonAI Agents version 1.6.77 and earlier. Any deployment using the `CodeAgent` component with LLM-generated code execution is at risk. The impact is severe because the attacker does not need to exploit complex remote code execution chains; they only need to influence the LLM's output to include malicious Python code. Once executed, the code has full access to the host's environment variables, potentially compromising cloud infrastructure, databases, and third-party API integrations.

What should you do?

Users of PraisonAI Agents should update to version 1.6.78 immediately. This patched version addresses the environment leak and implements necessary security controls. Until updated, users should avoid using the `CodeAgent` component with untrusted or user-influenced inputs. Additionally, administrators should audit their environment variables to ensure that sensitive credentials are not stored in variables accessible to the application process, although this is a mitigation rather than a fix.