Back to overview

CVE-2026-61439

HIGH
7.5
CVSS 3.1
Description
PraisonAI versions before 4.6.78 contain a prompt injection defense misconfiguration where the block threshold defaults to CRITICAL severity, allowing HIGH-level threats to pass through unblocked. Attackers can submit single-vector prompt injection attacks such as instruction overrides or financial manipulation that trigger HIGH severity detection but are logged without blocking, enabling system prompt extraction and unauthorized tool invocations.

Metadata

CVE ID
CVE-2026-61439
State
PUBLISHED
Assigner
VulnCheck
Reserved
2026-07-09 14:05 UTC
Published
2026-07-11 13:01 UTC
Last updated
2026-07-11 13:01 UTC
Primary CWE
CWE-1188
Initialization of a Resource with an Insecure Default
Vendor / Product
MervinPraison / PraisonAI
Sources
cve.org  ·  NVD

Severity & Metrics

7.5 HIGH CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products (1)
VendorProductPlatformVersions
MervinPraison PraisonAI — 0 < 4.6.78, 4.6.78
Weakness (CWE)
CWESourceDescription
CWE-1188 cna Initialization of a Resource with an Insecure Default
CVSS scores (2)
ScoreSeverityVersionSourceVector
8.7 HIGH 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
7.5 HIGH 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References (2)
Back to overview