CVE-2026-61443CWE-22

PraisonAI before 1.6.78 Remote Code Execution via SkillTools

High · published July 15, 2026

CVSS v4.0
8.6
EPSS
1%
Percentile
55.1
In the wild
Unconfirmed
What it is

PraisonAI before 1.6.78 contains a remote code execution vulnerability in SkillTools.run_skill_script() that executes scripts without path containment validation. Attackers can supply absolute file paths to execute arbitrary scripts from any filesystem location, including those outside the intended working directory.

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00769 · 55.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-07-15T11:25Z
EPSS history
Timeline
  • 15 JUL 11:25Z
    PraisonAI before 1.6.78 Remote Code Execution via SkillTools
    cvelistv5