CVE-2026-62176: Mervinpraison Praisonai

Critical severity, CVSS 9.1. EPSS: 0.5% chance of exploitation in the next 30 days.

PraisonAI is a multi-agent teams system. Prior to version 4.6.78, the `deploy/api.py` module generates Python server code by directly interpolating the `agents_file` parameter into an f-string that is then written to a file and executed via `subprocess.Popen()`. An attacker who controls the `agents_file` value (via CLI argument, configuration, or upstream API) can inject arbitrary Python code. Version 4.6.78 patches the issue.

Affected products

• Mervinpraison Praisonai: before 4.6.78 (fixed in 4.6.78)

Published 2026-10-07. Last modified 2026-10-07.