---
id: "GHSA-qh3g-555w-f82q"
kind: "vulnerability"
aliases: ["GHSA-qh3g-555w-f82q"]
title: "Duplicate Advisory: PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox"
severity: "high"
cvss: 7.3
epss: null
exploited: false
status: "withdrawn"
category: "ai-tooling"
products: [{"name": "PraisonAI", "fixed": [], "affected": "< 4.6.78", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["ai-agents", "ai-tooling", "cwe-78", "praisonai", "python", "workflow-automation"]
not_affected_if: ["no-inline-python-workflows", "trusted-workflow-files-only", "version-4.6.78-or-later"]
published_at: "2026-07-15T12:32:04+00:00"
first_seen_at: "2026-10-29T16:39:03+00:00"
updated_at: "2026-10-29T16:39:55+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-qh3g-555w-f82q", "first_seen_at": "2026-10-29T16:39:03+00:00"}]
---

# Duplicate Advisory: PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox

PraisonAI before 4.6.78 checks workflow script steps with an AST validator that does not block imports such as os followed by os.system() calls. An attacker who can supply a malicious YAML workflow file can run arbitrary operating system commands with the privileges of the PraisonAI process.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:PraisonAI affected < 4.6.78 fixed ?

## How to check

- Check the installed PraisonAI version with `pip show PraisonAI` and compare it to the affected range below.
- Look for YAML workflow files that run inline Python steps in any PraisonAI deployment.

## Fix

- PraisonAI: move to `4.6.78` or later (per the affected range; the advisory is withdrawn as a duplicate of GHSA-26mh-57q7-jfvr, so confirm the fix there).

## Timeline

- 2026-10-29T16:39:03+00:00 ghsa https://github.com/advisories/GHSA-qh3g-555w-f82q

## From the sources

### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-26mh-57q7-jfvr. This link is maintained to preserve external references.

### Original Description
PraisonAI before 4.6.78 contains a remote code execution vulnerability in JobWorkflowExecutor._exec_inline_python() due to insufficient AST validation of workflow script steps. Attackers can create malicious YAML workflow files with import os statements followed by os.system() calls that bypass sandbox checks and execute arbitrary OS commands with process privileges.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_