CVE-2026-41497 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-41497 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-41497 is a command injection vulnerability in PraisonAI, a multi-agent orchestration framework developed by Praison, specifically affecting the MCP (Model Context Protocol) command handling logic in the parse_mcp_command() function prior to version 4.6.9.

Technical Detail

The flaw exists because a prior remediation attempt for MCP command handling failed to implement a command allowlist or any argument validation within parse_mcp_command(), leaving the function open to arbitrary command injection. An attacker who can supply or influence MCP command input -- whether through a crafted agent task, API call, or malicious tool invocation -- can pass unsanitized arguments that the function will execute without restriction. Successful exploitation could result in remote code execution (RCE) on the host running the PraisonAI process, with the privileges of the underlying service account.

Exploitation Status

No known exploit has been publicly documented or observed as of this writing. This vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. The exploit maturity is assessed as no known exploit; however, the straightforward nature of command injection in an insufficiently patched function means the barrier to exploitation is low for a skilled attacker with access to the attack surface.

Who Is Targeting This

No specific threat actor attribution at this time. No campaigns or targeted sectors have been identified in connection with this vulnerability. Organizations deploying PraisonAI in automated pipeline or agentic AI environments should treat this as a high-priority exposure regardless of current attribution gaps.

What To Do

Upgrade PraisonAI to version 4.6.9 or later immediately, as this release is the first to address the incomplete fix. Given the critical CVSS score of 9.8 and the RCE potential, patching should be treated as urgent and not deferred to routine maintenance cycles. If immediate patching is not feasible, restrict access to any interfaces or APIs that allow external or untrusted input to reach MCP command handling logic, and consider disabling MCP-related functionality until the patch is applied. Monitor process execution logs on hosts running PraisonAI for anomalous child process spawning or unexpected shell invocations as a detection signal.