{"id":"CVE-2026-62176","aliases":["CVE-2026-61444","GHSA-g6j7-pffp-8whg","PYSEC-2026-4256"],"url":"https://o3.security/vulnerability/CVE-2026-62176","summary":"PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation","details":"### Summary\nThe `deploy/api.py` module generates Python server code by directly interpolating the `agents_file` parameter into an f-string that is then written to a file and executed via `subprocess.Popen()`. An attacker who controls the `agents_file` value (via CLI argument, configuration, or upstream API) can inject arbitrary Python code.\n\n### Details\n\n`src/praisonai/praisonai/deploy/api.py` (line 80):\n\n```python\ncode = f'''...\n    praisonai = PraisonAI(agent_file=\"{agents_file}\")\n...\n    \"agent_file\": \"{agents_file}\"\n...'''\n```\n\nThe generated code is then executed (line 190):\n```python\nsubprocess.Popen(['python', server_file])\n```\n\n`agents_file` is never sanitized or validated. A malicious value breaks out of the string context:\n\n```python\nagents_file = '\"); import os; os.system(\"id\"); #'\n# Generated code becomes:\n# praisonai = PraisonAI(agent_file=\"\"); import os; os.system(\"id\"); #\")\n```\n\nThe same pattern exists in `deploy/docker.py` (line 33) for Dockerfile generation.\n\n\n### PoC\n\n```python\n# The injection:\nagents_file = '\"); import os; os.system(\"id\"); #'\n\n# What the generated code looks like:\ntemplate = f'praisonai = PraisonAI(agent_file=\"{agents_file}\")'\nprint(template)\n# Output: praisonai = PraisonAI(agent_file=\"\"); import os; os.system(\"id\"); #\")\n```\n\n### Impact\n- **Arbitrary code execution** on the machine running the deploy command\n- **Supply chain risk** if `agents_file` comes from a configuration file or CI/CD pipeline","published":"2026-10-07T16:06:56.016Z","modified":"2026-10-21T02:58:53.061319537Z","cvss":{"score":9.1,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"PyPI","name":"praisonai","fixedVersion":"4.6.78"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62176.json"},{"type":"ADVISORY","url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-g6j7-pffp-8whg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62176"},{"type":"PACKAGE","url":"https://github.com/MervinPraison/PraisonAI"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:58:53.061319537Z"}}