CVE-2026-61434CWE-78

PraisonAI before 4.6.78 Allowlist Bypass via find -exec

High · published July 10, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
58.6
In the wild
Unconfirmed
What it is

PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell command execution that allows attackers to execute restricted commands via find's built-in -exec, -execdir, and -delete actions. Attackers can craft find commands with these built-in actions to read blocked files, delete files, or execute non-allowlisted binaries without triggering shell metacharacter filters.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00877 · 58.6th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-07-10T13:58Z
EPSS history
Timeline
  • 10 JUL 13:58Z
    PraisonAI before 4.6.78 Allowlist Bypass via find -exec
    cvelistv5