Praisonai AICoder 4.6.77 lacks path validation, enabling root command execution
Missing sanitization in Praisonai AICoder allows attackers to write files and run commands, prompting an urgent update to version 4.6.78.
Key points
- Praisonai AICoder versions up to 4.6.77 contain CVE-2026-61445, a critical vulnerability allowing arbitrary file writes and command execution.
- The flaw stems from missing path validation and command sanitization in the AICoder UI component, which exposes tools directly to the LLM.
- Praisonai released version 4.6.78 to address the issue, restoring necessary security checks for file operations and system commands.
Praisonai AICoder versions 4.6.77 and earlier contain a critical vulnerability that allows attackers to execute arbitrary commands and write files to any location on the host system. The flaw, identified as CVE-2026-61445, arises because the application’s UI component exposes file and command execution tools to the large language model without implementing path validation or command sanitization. According to the GitHub advisory, this lack of restrictions enables prompt injection attacks that can compromise the entire system.
How it unfolded
- The AICoder UI component was found to pass user-influenced inputs directly to system functions without filtering dangerous characters or paths.
- Attackers could use prompt injection to trick the LLM into calling the `write_to_file` function with absolute paths, bypassing directory constraints.
- The same mechanism allowed the `execute_command` function to run unsanitized shell commands, granting attackers control over the underlying operating system.
Who is affected
Organizations using Praisonai AICoder version 4.6.77 or any earlier release are at risk. The vulnerability is particularly severe in Docker environments where containers run as root, as confirmed by the advisory. Successful exploitation allows attackers to modify critical system files, such as `/etc/crontab` or `/root/.ssh/authorized_keys`, establishing persistent access. Managed service providers hosting these environments must assess their client deployments immediately, as the lack of sandboxing means an attacker can move laterally from the application to the host.
The fix
Praisonai addressed the vulnerability by releasing version 4.6.78 of the AICoder package. This update introduces the missing path validation and command sanitization checks required to prevent arbitrary file writes and command execution. Administrators should verify their current installed versions and upgrade to 4.6.78 as soon as possible. No other patches or workarounds have been confirmed by the vendor for earlier versions.
What to do and how to stay safe: Praisonai
- Audit all Praisonai AICoder installations to identify versions 4.6.77 or lower and prioritize them for immediate patching.
- Restrict network access to AICoder chat interfaces, ensuring only authorized users can interact with the LLM tools.
- Monitor system logs for unexpected file creation in sensitive directories like `/etc` or `/root` following user interactions.
- Review Docker configurations to ensure containers do not run as root where possible, limiting the blast radius of any potential compromise.
Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-61445?
It is a critical vulnerability in Praisonai AICoder that allows arbitrary file writes and command execution due to missing input validation.
Which versions of Praisonai AICoder are vulnerable?
Versions 4.6.77 and earlier are affected by this flaw and require updating to version 4.6.78.
Can this vulnerability be exploited remotely?
Yes, attackers can exploit it through prompt injection in the chat interface if they have access to the application.
