Package impact
PIP / praisonai
| CVE | Severity | CVSS | Risk | Published | Description | Impact |
|---|---|---|---|---|---|---|
| CVE-2026-41497 | critical | 9.8 | 9.8 | 20d ago | PraisonAI has an incomplete fix for CVE-2026-34935 - OS Command Injection | |
| CVE-2026-39890 | critical | — | 9.5 | 2mo ago | PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading | |
| CVE-2026-44334 | high | 8.4 | 8.4 | 20d ago | PraisonAI has unauthenticated RCE via `tool_override.py` (CVE-2026-40287 patch bypass) | |
| CVE-2026-41496 | high | 8.1 | 8.1 | 20d ago | PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315) |