The report
A PraisonAI security advisory describes workflow code accepted through an AST-based filter that failed to exclude executable Python operations when the affected workflow feature was enabled. The relevant boundary is generated or supplied workflow code being interpreted with server authority, not a simple prompt that persuades the model to disclose text.
The issue has been described under GHSA-26mh-57q7-jfvr, with inconsistent CVE metadata across sources. GitHub's advisory identifies CVE-2026-61438; an alternative assignment elsewhere should not become a second independent exploit without confirming the alias. The advisory evidence and canonical Case retain one underlying vulnerability with its necessary feature-flag condition.
A safe regression should feed harmless but previously forbidden Python patterns into the configured workflow path and confirm that execution-time sandboxing, not a syntax-only denylist, enforces the intended capability boundary. A disabled optional execution feature changes exposure; a vulnerable installation should not automatically be described as an anonymous, universally reachable command shell.