CVE-2026-61444 is a critical code injection vulnerability in MervinPraison's PraisonAI product affecting versions prior to 4.6.78. The flaw exists in the deploy/api.py file where the agents_file parameter is unsafely interpolated into an f-string, enabling attackers to inject and execute arbitrary Python code during server code execution via subprocess.Popen(). This vulnerability allows remote code execution with high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows attackers with high privileges to execute arbitrary Python code on the server running PraisonAI, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability of the affected system. Given the critical CVSS score of 9.4, the risk is severe if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using affected versions in untrusted environments and restrict access to the vulnerable functionality. Monitor vendor communications for updates on patches or mitigations.