Praisonai AICoder vulnerability allows arbitrary file write and command execution
A critical flaw in Praisonai’s AICoder component enables attackers to write files anywhere on the filesystem and execute commands via prompt injection.
Key points
- CVE-2026-61445 affects Praisonai versions 4.6.77 and earlier.
- The vulnerability allows arbitrary file writes, including to /root/.ssh/authorized_keys.
- Patched version 4.6.78 is available to mitigate the risk.
A critical security vulnerability in the Praisonai software package allows attackers to perform arbitrary file writes and execute commands on affected systems. The flaw, tracked as CVE-2026-61445, exists in the AICoder UI component and stems from insufficient validation of user inputs processed by the large language model (LLM).
At a glance
- Advisory
- GHSA-9mp3-24cc-77mg
- CVE
- CVE-2026-61445
- Package
- praisonai (pip)
- Severity
- Critical
- Patched in
- 4.6.78
The vulnerability enables an attacker to write files to any location on the host filesystem, including sensitive paths such as /root/.ssh/authorized_keys and /etc/crontab. Additionally, the lack of command sanitization allows for arbitrary command execution through the chat interface. According to the GitHub advisory GHSA-9mp3-24cc-77mg, the issue is rated as critical due to the potential for full system compromise, particularly in Docker containers that run as root.
Technical Details
The core issue lies in the `write_to_file` and `execute_command` tools exposed to the LLM within the `aicoder.py` module. The `write_to_file` function does not validate file paths, allowing attackers to traverse directories using absolute paths. Although the code uses `os.path.join`, this method does not prevent absolute path traversal, meaning an input like `/etc/passwd` bypasses intended directory restrictions.
Similarly, the `execute_command` function lacks command sanitization, allowlists, or sandboxing. The command string is derived from LLM tool-call responses, which are influenced by user input. This creates a direct path for prompt injection attacks. An attacker can craft a message that causes the LLM to invoke `write_to_file` with a malicious path and content, or to execute a system command that establishes a backdoor or exfiltrates data.
Who Is Affected
Users of Praisonai versions 4.6.77 and earlier are vulnerable to this attack. The impact is maximized in environments where the application runs with elevated privileges, such as Docker containers operating as root. In such configurations, an attacker can modify system files, install persistent backdoors via cron jobs, or gain unauthorized SSH access by writing to authorized keys files. Organizations relying on Praisonai for AI-driven coding assistance should verify their installed versions immediately.
What should you do?
Administrators should update their Praisonai installations to version 4.6.78 or later, which patches the vulnerability. Until updates are applied, restrict access to the AICoder interface and monitor for unusual file modifications or command executions. Review system logs for signs of prompt injection attempts or unauthorized file writes.
Background: Large language models
Large language models are a specific type of neural network trained on text. Generative AI is the broader umbrella term for any system that creates new content, including images and code. Not all generative AI uses large language models, but most modern text generators do.
What to do and how to stay safe: Praisonai
- Update Praisonai to version 4.6.78 or later to apply the vendor-provided fix.
- Audit system files such as /etc/crontab and /root/.ssh/authorized_keys for unauthorized changes.
- Restrict network access to the AICoder interface to trusted users only.
- Monitor application logs for anomalous LLM tool-call responses or command executions.
Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-61445?
It is a critical vulnerability in Praisonai’s AICoder component that allows arbitrary file write and command execution via prompt injection.
Which versions of Praisonai are affected?
Versions 4.6.77 and earlier are vulnerable. Version 4.6.78 contains the patch.
How can an attacker exploit this vulnerability?
By sending crafted messages to the chat interface that cause the LLM to invoke unsafe file write or command execution functions without proper validation.
