On October 7 and 8, 2026, GitHub published a cluster of security advisories for PraisonAI, an open-source multi-agent framework distributed on PyPI and npm. At least two are rated critical and several more high.
The headline is CVE-2026-61447 (GHSA-2xv2-w8cq-5gxw, CVSS 3.1 score 10.0) in the praisonaiagents package. Its CodeAgent wrote LLM-generated Python to a temporary file and ran it in a subprocess with a full copy of the parent environment, with no AST validation, no import restrictions and no sandbox enforcement, even when a developer explicitly set CodeConfig(sandbox=True). Anyone able to influence the model’s output, through prompt injection in agent input, tool results or ingested content, could read every API key, database credential and cloud token in the environment and run arbitrary code. It is fixed in praisonaiagents 1.6.78. CVE-2026-61445 (CVSS 9.9) found the AICoder UI component exposing write_to_file and execute_command tools to the model with no path validation or command sanitization, so prompt injection in the chat could write to locations such as /root/.ssh/authorized_keys in containers that run as root.
Two more advisories are about defaults. The npm AgentOS server (CVE-2026-61426) bound to all interfaces with no API key and wildcard CORS, exposing agent system prompts and an endpoint that runs agents to any network peer. The MCP HTTP-stream server (CVE-2026-61427) authenticated requests only when a key was configured, and the CLI defaulted to none, exposing about 50 tools without authentication.
Why it matters: a configuration flag named sandbox that does nothing is the worst kind of security control, because it gives developers a reason to stop worrying. Together the advisories map the standard failure set for agent frameworks: model output treated as trusted code, tools with no guardrails, and network servers that ship open.
What it does not show: the advisories report no exploitation of these flaws, and several, including the open-by-default servers, require network access to a deployment that a developer chose to run. Fixes were available in the patched versions listed in each advisory at publication.