PraisonAI Agents 1.6.78 patches CVE-2026-61447 to block LLM code from stealing API keys via sandbox flaw

PraisonAI Agents has released version 1.6.78 to address a critical security vulnerability that allowed attackers to steal environment secrets and execute arbitrary code on host systems. The flaw, tracked as CVE-2026-61447, existed in the software’s code execution module and affected versions up to and including 1.6.77.

In plain English

The vulnerability stems from how the application handles Python code generated by large language models. When the agent is configured to run code in a sandbox, users expect that code to be isolated from the rest of the system. In reality, the software passed every environment variable from the parent process to the subprocess running the generated code.

Environment variables often contain sensitive data such as database credentials, cloud provider tokens, and API keys. Because the sandbox did not block access to these variables, any code executed by the agent could read them. Furthermore, the system did not validate the structure of the code before running it. This means an attacker who could influence the input to the large language model could trick it into generating code that exfiltrates these secrets or performs other malicious actions on the host machine.

The background

The issue was identified in the `_execute_python` function within the PraisonAI Agents package. According to the GitHub advisory GHSA-2xv2-w8cq-5gxw, the function used `os.environ.copy()` to pass the full environment to the subprocess. This behavior persisted even when administrators explicitly set the `sandbox=True` configuration option.

The advisory notes that other parts of the codebase, such as the `execute_code` tool in `python_tools.py`, correctly used an empty environment dictionary to prevent data leakage. However, the main code execution agent lacked this safeguard. There were no restrictions on imports and no validation of the abstract syntax tree, leaving the execution context wide open.

What changes now

PraisonAI Agents has published version 1.6.78, which patches the vulnerability. Users running version 1.6.77 or earlier should update immediately to prevent potential secret exfiltration and code execution. The update addresses the environment variable leakage and restores the intended security boundaries for the code execution sandbox.

What to do and how to stay safe: PraisonAI Agents

• Update PraisonAI Agents to version 1.6.78 or later to apply the security fix.
• Rotate any environment variables or secrets that may have been exposed by running unpatched versions.
• Review logs for unusual subprocess activity or unauthorized code execution attempts.
• Monitor for new advisories regarding code execution modules in AI agent frameworks.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-61447?

It is a critical vulnerability in PraisonAI Agents that allows LLM-generated code to access environment variables and execute arbitrary commands.

Which versions of PraisonAI Agents are affected?

All versions up to and including 1.6.77 are vulnerable. Version 1.6.78 contains the fix.

Does setting sandbox=True protect against this flaw in older versions?

No, the sandbox configuration was ineffective in vulnerable versions because the code still passed the full parent environment to the subprocess.