CVE-2026-61434 describes an OS command injection vulnerability in MervinPraison's PraisonAI product versions prior to 4.6.78. The issue arises from an allowlist bypass in the shell command execution logic, where attackers can exploit the find command's built-in actions (-exec, -execdir, -delete) to perform unauthorized operations such as reading blocked files, deleting files, or executing binaries that are not on the allowlist. This bypass circumvents shell metacharacter filters intended to restrict command execution.

Successful exploitation allows an attacker with limited privileges to execute arbitrary commands on the affected system, potentially leading to unauthorized file access, file deletion, and execution of unauthorized binaries. This could result in data loss, system compromise, or further escalation depending on the environment and privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to vulnerable versions and monitor for suspicious use of the find command with -exec, -execdir, and -delete actions. Avoid running PraisonAI with elevated privileges where possible.