CVE-2026-61439: Prompt injection defense bypass in PraisonAI

PraisonAI versions before 4.6.78 shipped with the InjectionDefense block threshold defaulting to CRITICAL, letting single-vector HIGH-severity prompt injections through. The flaw, tracked as CVE-2026-61439 with a CVSS score of 7.5, allows system prompt extraction and unauthorized agent tool execution; it is fixed in 4.6.78.

• CVSS 7.5 (High), CWE-1188, network attack vector
• Affects PraisonAI and praisonaiagents below 4.6.78
• Block threshold lowered from CRITICAL to HIGH in commit 393de39
• Proof-of-concept exists; not listed in CISA KEV