CVE-2026-60086: PraisonAI Prompt Injection Defense Bypass (v4.6.78)

Technical summary

CVE-2026-60086 is a prompt injection defense bypass in PraisonAI affecting versions prior to 4.6.78. The vulnerability stems from an insufficiently restrictive classification threshold in the injection defense mechanism. The system blocks only threats classified as CRITICAL severity, a threshold requiring simultaneous matches across three or more detector families. Attackers can craft single or double-vector prompt injections that trigger only HIGH-level threat classifications, circumventing the defense and reaching the language model. This represents a failure in layered defense design where the protection strategy depends on a single severity cutoff rather than a more nuanced risk model.

Business impact

This vulnerability enables attackers to inject malicious prompts into PraisonAI systems without triggering automated safeguards. Depending on how PraisonAI is deployed, successful prompt injection could lead to data exfiltration, model manipulation, unauthorized information access, or misuse of the AI for generating harmful content. For organizations using PraisonAI in customer-facing or data-sensitive applications, the risk includes reputational damage, compliance violations, and loss of user trust. The impact is moderated by the MEDIUM severity rating and the requirement for network access, but the ease of crafting bypassing prompts makes this a practical risk.

Affected systems

PraisonAI installations running versions before 4.6.78 are vulnerable. The vulnerability is network-accessible (no authentication required) and does not depend on user interaction or system configuration. Any deployment of affected PraisonAI versions is exposed if it processes untrusted prompt input from external sources.

Exploitability

Exploitation requires only network access and the ability to send a crafted prompt to a vulnerable PraisonAI instance. No special privileges, authentication, or user interaction are needed. The barrier to exploitation is low—attackers can use common prompt injection techniques adjusted to fall below the CRITICAL detection threshold. The CVSS score of 5.3 reflects the low complexity and high accessibility of the attack vector, though the impact is limited to integrity (prompt manipulation rather than confidentiality breach or availability loss).

Remediation

Organizations must upgrade PraisonAI to version 4.6.78 or later. The patched version is expected to address the defense bypass by either raising the detection threshold, improving the detector tuning to catch HIGH-severity injections, or implementing a more robust multi-layered defense strategy. Verify the specific improvements in the vendor advisory before deployment.

Patch guidance

Apply PraisonAI version 4.6.78 or later as soon as feasible. Verify the patch release notes confirm remediation of the prompt injection bypass. Test the update in a non-production environment first to ensure compatibility with your workflows. After patching, consider conducting prompt injection testing to validate the defense improvements. Since the vulnerability requires network access, prioritize patching any internet-facing or user-accessible PraisonAI instances.

Detection guidance

Monitor PraisonAI instances for HIGH-severity threat classifications that are being allowed to proceed to the model. Log and alert on prompt inputs that contain known injection patterns (such as jailbreak phrases, privilege escalation attempts, or data extraction commands) even if they do not trigger CRITICAL classification. Implement network-level monitoring to detect unexpected query patterns or volumes that may indicate active exploitation. Review model outputs for signs of manipulation or unexpected behavior that could indicate successful injection attacks.

Why prioritize this

While the CVSS score is MEDIUM (5.3), the practical ease of exploitation and the low barrier to attack (no authentication, no complexity) make this a near-term priority for any organization running PraisonAI. The vulnerability is not currently tracked in CISA's Known Exploited Vulnerabilities catalog, but the simplicity of crafting bypassing prompts means exploitation risk will grow as awareness spreads. Prioritize patching if PraisonAI is used in production or customer-facing applications.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects a MEDIUM severity vulnerability with network accessibility (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), and no user interaction (UI:N). The impact is limited to integrity (I:L) with no confidentiality or availability impact, which caps the score below HIGH. However, the real-world exploitability is higher than the score suggests because the defense mechanism is fundamentally flawed; improving detection tuning alone may not fully address the underlying design issue.

Frequently asked questions