High severity7.5NVD Advisory· Published Jul 15, 2026· Updated Jul 15, 2026
CVE-2026-60085
CVE-2026-60085
Description
PraisonAI before 4.6.78 contains an unenforced security policy vulnerability in the default Subprocess Sandbox backend where blocked_commands, blocked_paths, blocked_imports, allow_subprocess, and allow_file_write restrictions are completely ignored. Attackers can execute arbitrary subprocess commands, read sensitive files, and perform destructive operations despite explicit security policy configuration.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
praisonaiPyPI | < 4.6.78 | 4.6.78 |
Affected products
2Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-5r6c-gj4g-r697ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-60085ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-62177ghsaADVISORY
- github.com/MervinPraison/PraisonAI/security/advisories/GHSA-5r6c-gj4g-r697nvdWEB
- www.vulncheck.com/advisories/praisonai-before-unenforced-security-policy-in-subprocess-sandboxnvdWEB
News mentions
0No linked articles in our index yet.