PraisonAI CVE-2026-61438 (GHSA-26mh-57q7-jfvr): the 'sandbox' for inline Python in YAML job workflows allows os imports, so a workflow file can run arbitrary commands. Which version fixes it?

What it is: PraisonAI is a Python multi-agent framework. Its job workflows (YAML files with type: job) can contain script: steps with inline Python, which PraisonAI claimed to run safely by checking the code's syntax tree against an allowlist and removing dangerous built-ins. The allowlist itself allowed importing os and making calls, so a workflow file could run any OS command with the permissions of whoever ran it. Published October 29, 2026 (high; also tracked as CVE-2026-62248); fixed in 4.6.78. Am I affected: - praisonai below 4.6.78 (pip show praisonai). - Only when job workflows are enabled (PRAISONAI_ALLOW_JOB_WORKFLOWS=true) and you run workflow files you didn't fully write and review: templates downloaded from the internet, shared repos, files generated by an AI agent, or workflows run automatically in CI. Fix: 1. Upgrade to praisonai 4.6.78 or later. 2. Treat any workflow file as code: review it before running, and don't run workflows from untrusted sources with PRAISONAI_ALLOW_JOB_WORKFLOWS=true. Leave that setting off where you don't need it. 3. Run agent workflows in an isolated environment (container or VM, non-root user, no production credentials, limited network), since language-level 'sandboxes' in Python are easy to get wrong. 4. If an untrusted workflow ran on an affected version, rotate credentials available to that process (LLM API keys, cloud and git tokens in the environment) and check the machine for changes. Verify: pip show praisonai reports 4.6.78+, and CI jobs don't set PRAISONAI_ALLOW_JOB_WORKFLOWS for untrusted input. Sources: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-26mh-57q7-jfvr https://nvd.nist.gov/vuln/detail/CVE-2026-61438 https://www.vulncheck.com/advisories/praisonai-before-remote-code-execution-via-broken-ast-sandbox