CVE-2026-61445 Splunk · SPL

Detect PraisonAI AICoder Arbitrary File Write and Command Execution via LLM Tool Calls (CVE-2026-61445) in Splunk

Detects exploitation of CVE-2026-61445, a critical (CVSS 9.9) arbitrary file write and OS command execution vulnerability in the PraisonAI Python package (praisonai <= 4.6.77). The AICoder tool-call surface allows LLM-driven tool invocations to write files outside the intended working directory (CWE-22 path traversal) and to execute arbitrary shell commands (CWE-78), leading to remote code execution on the host running the agent. This detection surfaces anomalous child-process spawns from the Python interpreter hosting PraisonAI, suspicious file writes to sensitive paths, and traversal sequences in tool-call arguments.

MITRE ATT&CK

Tactic
Execution Initial Access

SPL Detection Query

Splunk (SPL)
spl 
index=edr sourcetype="process:events" (parent_process_name IN ("python","python3","python.exe","uvicorn","gunicorn")) (parent_process="*praisonai*" OR parent_process="*aicoder*" OR parent_process="*praisonaiagents*")
| where match(process_name,"(?i)(bash|sh|zsh|cmd\.exe|powershell|pwsh|nc|ncat|curl|wget|base64|chmod)") OR match(process,"(?i)(\.\./|%2e%2e|/etc/cron|authorized_keys|bash -i|-c )")
| stats count min(_time) as firstTime max(_time) as lastTime values(process) as process_cmds by host, user, parent_process, process_name
| convert ctime(firstTime) ctime(lastTime)
| sort - count
critical severity medium confidence

Surfaces suspicious child processes and traversal/command-injection indicators spawned by a PraisonAI/AICoder Python host.

Data Sources

EDR process telemetrySysmon

Required Sourcetypes

process:eventsXmlWinEventLog:Microsoft-Windows-Sysmon/Operational

False Positives & Tuning

  • Legitimate agent workflows that invoke build or test subprocesses
  • Developer machines running PraisonAI interactively
  • Automation wrappers that intentionally shell out

Other platforms for CVE-2026-61445

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1 PraisonAI AICoder command execution via tool call

    Expected signal: Process creation event showing python3 spawning /bin/bash -c with an id command

  2. Test 2 PraisonAI AICoder arbitrary file write via path traversal

    Expected signal: File creation event for a path containing ../ outside the agent working directory

  3. Test 3 PraisonAI AICoder persistence write to authorized_keys

    Expected signal: File write event targeting an authorized_keys path from a Python/PraisonAI process

Last updated: 2026-10-23 Research depth: standard
References (4)

Response Playbook

Triage

  1. Confirm the PraisonAI version on the affected host (`pip show praisonai`); versions <= 4.6.77 are vulnerable to CVE-2026-61445.
  2. Review the parent Python command line and the full set of child processes/file writes to determine whether the activity matches a legitimate agent task or attacker-controlled tool calls.
  3. Inspect LLM tool-call logs / prompt history for the agent to identify the triggering prompt and any traversal (`../`) or shell payloads in tool arguments.
  4. Check for files written outside the intended working directory (cron entries, SSH authorized_keys, web roots, startup scripts) around the event timestamp.

Containment

  1. Isolate the affected host from the network to prevent lateral movement or C2 from any spawned reverse shell.
  2. Stop/kill the PraisonAI agent process and disable the service or scheduled job that launches it until patched.
  3. Rotate any credentials, API keys (including LLM provider keys) and tokens accessible to the agent process.

Evidence Collection

  1. Capture the full process tree, command lines, and timestamps for the Python parent and all descendants.
  2. Preserve PraisonAI/AICoder application logs, LLM tool-call transcripts, and the offending prompt(s).
  3. Collect and hash any files written by the agent outside its working directory and any dropped payloads for forensic analysis.

Escalation Criteria

  • !Escalate to IR if evidence shows successful arbitrary command execution (reverse shell, new persistence, credential access).
  • !Escalate if the agent process runs with elevated privileges or on a host with access to production/sensitive data.
  • !Escalate if attacker-controlled file writes landed in persistence locations (cron, systemd, authorized_keys, web roots) or if outbound C2 is observed.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Process creation events linking a Python/PraisonAI parent to shell or network utility children
  • >Files written outside the agent working directory (cron, authorized_keys, web roots, startup scripts)
  • >PraisonAI/AICoder tool-call transcripts and prompt history showing traversal or command payloads
  • >Outbound network connections from the agent host to unexpected destinations

Tuning Guidance

Establish a baseline of expected subprocesses for legitimate AICoder tasks in your environment (e.g., git, test runners, package managers) and allowlist those parent+child combinations. Tighten on traversal tokens and persistence-path writes, which should never appear in normal agent operation. Prioritize alerts where the agent process runs as root/SYSTEM or on internet-facing hosts.

Hunting Queries

Baselines the children and command lines spawned by PraisonAI/AICoder hosts to spot anomalous shell/command execution.

Hunting — KQL
kql 
DeviceProcessEvents | where InitiatingProcessCommandLine has_any ("praisonai","aicoder") | summarize count() by FileName, ProcessCommandLine, DeviceName | order by count_ desc
Hunting — SPL
spl 
index=edr (parent_process="*praisonai*" OR parent_process="*aicoder*") | stats count by host, process_name, process | sort - count

Atomic Red Team Tests

Test 1 PraisonAI AICoder command execution via tool call
linux

Simulates an LLM tool call that causes AICoder to execute an arbitrary shell command, representing the CWE-78 path of CVE-2026-61445.

Command

bash 
python3 -c "import subprocess; subprocess.run(['/bin/bash','-c','id > /tmp/praisonai_poc.txt'])"

Cleanup

bash 
rm -f /tmp/praisonai_poc.txt

Expected Telemetry

Process creation event showing python3 spawning /bin/bash -c with an id command

Expected Detection

KQL/SPL/EDR rules flag a shell child process with a -c payload under a Python parent referencing praisonai/aicoder

Test 2 PraisonAI AICoder arbitrary file write via path traversal
linux

Simulates the CWE-22 arbitrary file write by writing a file outside the intended working directory using a traversal sequence.

Command

bash 
mkdir -p /tmp/aicoder_work && cd /tmp/aicoder_work && python3 -c "open('../../tmp/praisonai_traversal.txt','w').write('poc')"

Cleanup

bash 
rm -f /tmp/praisonai_traversal.txt; rm -rf /tmp/aicoder_work

Expected Telemetry

File creation event for a path containing ../ outside the agent working directory

Expected Detection

Detection flags traversal sequences in tool-call arguments and sensitive-path file writes

Test 3 PraisonAI AICoder persistence write to authorized_keys
linux

Simulates an attacker using the file-write primitive to drop an SSH key into a user's authorized_keys for persistence.

Command

bash 
mkdir -p /tmp/poc_home/.ssh && python3 -c "open('/tmp/poc_home/.ssh/authorized_keys','a').write('ssh-ed25519 AAAAC3PoCKEY attacker@poc\n')"

Cleanup

bash 
rm -rf /tmp/poc_home

Expected Telemetry

File write event targeting an authorized_keys path from a Python/PraisonAI process

Expected Detection

Detection flags writes to authorized_keys/persistence paths originating from the agent host

Related Detections

Tactic Hubs

TA0002 Execution TA0001 Initial Access ATT&CK Matrix

Related Techniques

T1059 Command and Scripting Interpreter T1190 Exploit Public-Facing Application T1505.003 Web Shell

Same Tactic: Execution

Popular Detections