Unvalidated LLM Code Execution in PraisonAI

PraisonAI before 1.6.78 contains a remote code execution vulnerability in CodeAgent._execute_python() that executes LLM-generated Python code without AST validation, import restrictions, or sandbox enforcement. Attackers can influence LLM output through prompt injection to exfiltrate all environment secrets and execute arbitrary code on the host system.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

PraisonAI before version 1.6.78 contains a critical remote code execution vulnerability in its CodeAgent._execute_python() function that blindly executes Python code generated by language models without any validation, sandboxing, or import restrictions. This vulnerability matters because it turns LLM output—which attackers can manipulate through prompt injection—into arbitrary code execution on the host system. Organizations deploying PraisonAI for autonomous code generation, particularly those integrating it into CI/CD pipelines, data processing workflows, or development environments, face immediate risk of full system compromise, credential theft, and lateral movement across their infrastructure.

Casky's 322 matching security skills help practitioners detect the attack patterns behind this vulnerability by mapping to MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance) alongside CWE-94 (Improper Control of Generation of Code). Using Claude AI with extended reasoning, practitioners would identify detection signals such as: suspicious Python subprocess execution spawned from LLM processing contexts, unexpected environment variable access patterns indicating credential exfiltration attempts, and anomalous module imports (particularly os, subprocess, sys) within dynamically generated code execution flows. The skills would guide security teams to implement AST-based code validation before execution, enforce Python sandboxing with restricted imports, and establish monitoring for LLM-to-execution pipelines—transforming raw vulnerability data into actionable defensive patterns specific to their environment.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-61447.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-61447

Casky has 322 skills that investigate the attack patterns behind CVE-2026-61447. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn