PraisonAI offered a workflow path that evaluated Python under a check intended to forbid dangerous operations. The advisory identifies allowed AST constructs and imports that could still admit operating-system operations, so the source filter did not provide the sandbox that its operator might expect. Exploitability depends on enabling…
Inspect the ClaimsCase · DiggingBeagle record
PraisonAI workflow AST allowlist admitted unsafe Python operations under an opt-in flag
PraisonAI job workflow parsing could execute restricted Python through a defective AST allowlist when job workflows were enabled.
Scope
PraisonAI installations with job workflows enabled and attacker influence over YAML job content; affected releases before 4.6.78. No verified public exploitation campaign.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade C
- Remediation
- fixed reported
- AI role
- AGAINST AI
Basis and provenance
The advisory supports a conditional code-execution flaw; deployments without the enabled workflow path and real victim effects are unmeasured. Impact remains unrated because the scoped record does not establish a calibrated severity-to-impact-band mapping.
Assessed Oct 31, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-C26-PRAISON-AST-WORKFLOW-1 · PraisonAI GHSA-26mh-57q7-jfvr: broken workflow AST sandbox
At a glance
A GHSA with conflicting CVE aliases is one underlying issue until CNA records establish otherwise.
Read the implicationsThe alternate CVE identifier requires CNA-level reconciliation and must not count as another attack. The effective OS identity used by a deployed job worker varies by operator configuration.
Limits and uncertaintyFull account
PraisonAI offered a workflow path that evaluated Python under a check intended to forbid dangerous operations. The advisory identifies allowed AST constructs and imports that could still admit operating-system operations, so the source filter did not provide the sandbox that its operator might expect. Exploitability depends on enabling PRAISONAI_ALLOW_JOB_WORKFLOWS and the ability to submit a workflow; the finding is not a default anonymous internet endpoint. The reviewed GitHub record lists CVE-2026-61438 and a fix in 4.6.78.
A separate publisher reported a different CVE number, CVE-2026-62248, against the same GHSA. That metadata disagreement is not evidence of two independent vulnerabilities. This Case uses the canonical GHSA and the reviewed advisory’s CVE, while retaining the alias conflict as a reconciliation task. The security check should be grounded in what Python actually executes in an isolated process, not in a syntactic list of permitted source constructs.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Timeline
- Oct 29, 2026disclosure
Public disclosure
Claims & evidence
CLM-C26-PRAISON-AST-WORKFLOW-1GitHub’s reviewed GHSA-26mh-57q7-jfvr reports a broken Python AST sandbox in PraisonAI job workflows before 4.6.78, and identifies CVE-2026-61438.supported
Basis: reported finding
- supportsPraisonAI GHSA-26mh-57q7-jfvr: broken workflow AST sandboxprimary disclosure
Reviewed GitHub advisory, affected versions, AST sandbox defect and fixed version
Implications
A GHSA with conflicting CVE aliases is one underlying issue until CNA records establish otherwise.
Controls and mitigations
- Upgrade to the vendor-fixed build, require trusted workflow authors and enforce operating-system isolation beyond an AST checklist.
Unknowns and contradictions
- The alternate CVE identifier requires CNA-level reconciliation and must not count as another attack.
- The effective OS identity used by a deployed job worker varies by operator configuration.
Sources and citation
Material revision history
- Oct 31, 2026 · Canonical change recorded · new in release · revision 208