PraisonAI AICoder Prompt Injection to Arbitrary File Write and Root Command Execution

Technical Analysis

CVE-2026-61445 stems from missing path validation and command sanitization in the AICoder tool-calling logic used by PraisonAI's LLM agent to write and execute code on behalf of users. An attacker can craft a prompt injection payload delivered through the chat interface that manipulates the LLM into invoking file-write and shell-execution tools with attacker-controlled paths and commands, bypassing intended sandboxing. Because the underlying agent process appears to run with root privileges, successful exploitation grants full host compromise, including the ability to overwrite system binaries, plant persistence mechanisms, or exfiltrate credentials and API keys from the host environment. This is a direct and severe example of agent-relevant risk: any organization running PraisonAI-based agents for coding, automation, or RAG-integrated tool use is exposed to remote code execution simply by allowing untrusted or semi-trusted input to reach the LLM chat interface, making this a priority patch for all AI agent deployments using this framework.

Affected Systems

PraisonAI versions prior to 4.6.78, specifically deployments using the AICoder component with LLM tool-calling enabled and running with elevated (root) privileges; affects self-hosted and containerized PraisonAI agent installations exposed to user or external chat input.

Indicators of Compromise

• No specific IOCs published at this time; monitor for: unexpected file writes outside designated workspace directories by PraisonAI processes
• Anomalous shell command execution spawned by PraisonAI/AICoder processes
• Unexpected outbound connections from hosts running PraisonAI agents
• Modified or newly created files in /etc, /usr/bin, or other system directories correlating with PraisonAI process activity

Remediation Steps

1. 1

   Upgrade PraisonAI immediately

   Update all PraisonAI installations to version 4.6.78 or later, which addresses the path validation and command sanitization flaws in AICoder.

2. 2

   Run agents with least privilege

   Ensure PraisonAI and AICoder processes run under a dedicated non-root, low-privilege service account rather than root, and enforce filesystem permission boundaries via containerization or chroot/jail mechanisms.

3. 3

   Restrict and sanitize chat input

   Implement input filtering and prompt injection detection at the chat interface layer to reduce the likelihood of malicious payloads reaching the LLM tool-calling logic.

4. 4

   Sandbox tool execution

   Isolate AICoder's file write and command execution tool calls in a sandboxed environment (e.g., containers with read-only root filesystems, seccomp profiles) with an allow-list of permitted paths and commands.

5. 5

   Audit and monitor

   Review logs for unusual file writes and command executions from PraisonAI processes, and deploy host-based monitoring/EDR to detect exploitation attempts retroactively and going forward.

6. 6

   Rotate exposed credentials

   If any PraisonAI instance was internet-facing or handled untrusted input prior to patching, rotate API keys, secrets, and credentials accessible to the agent host as a precaution.