Tools AI Risk Radar ai-incident-0190
Incident record
PraisonAI AICoder fixes unrestricted file and command tools
- Severity
- Critical
- Status
- Patched
- Type
- Infra Vuln
- Target
- PraisonAI AICoder through 4.6.77
- Actor
- researcher
- CVE
- CVE-2026-61445
What happened
Crafted chat input could invoke file-writing and command tools without adequate permission checks. Running the service in a root container increased the impact.
Version 4.6.78 fixes the issue. The original advisory was published on 25 June; the global CVE entry followed on 8 October. The maintainer rates it Critical, with CVSS 3.1 score 9.9.
Sources
- Primary disclosuregithub.com/MervinPraison/PraisonAI/security/advisories/GHSA-…
- Supporting primary sourcegithub.com/advisories/GHSA-9mp3-24cc-77mg
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026