Prompt Injection Defense Bypass in PraisonAI

Executive Summary

CVE-2026-60086 is a vulnerability in PraisonAI versions before 4.6.78 where the prompt injection defense mechanism is bypassed. The defense only blocks threats classified as CRITICAL, which requires three or more detector families to simultaneously detect the threat. However, attackers can craft prompt injections classified as HIGH threat level that do not meet this threshold and thus pass through unblocked to reach the AI model.

The root cause is that the system's scan function only sets a block when the threat level is CRITICAL and detected by multiple detector families, ignoring HIGH-level threats. This allows single or double-vector prompt injections, including common attack phrases, to bypass the defense.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to bypass the prompt injection defenses of PraisonAI and send malicious inputs to the AI model. As a result, attackers can manipulate the system's behavior by injecting crafted prompts that are not blocked.

• Attackers can execute prompt injections that influence or control the AI's responses.
• The system may perform unintended actions or reveal sensitive information due to manipulated prompts.
• Because the defense mechanism fails to block HIGH-level threats, the risk of exploitation is significant even without complex attack vectors.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability involves prompt injections classified as HIGH threat level bypassing the defense mechanism because it only blocks CRITICAL threats detected by three or more detector families simultaneously.

Detection would involve monitoring for prompt injection attempts that include common single-vector injection phrases such as "Ignore all previous instructions" or other suspicious inputs that could be classified as HIGH threat but not blocked.

Since the vulnerability is related to the internal prompt injection defense logic of PraisonAI, direct network or system commands to detect this vulnerability are not explicitly provided in the available resources.

However, general detection could include logging and analyzing inputs sent to PraisonAI for suspicious prompt injection patterns and monitoring for unexpected model behavior triggered by such inputs.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating PraisonAI to version 4.6.78 or later, where the prompt injection defense bypass vulnerability has been addressed.

If updating is not immediately possible, consider implementing additional filtering or sanitization of inputs classified as HIGH threat level, rather than relying solely on blocking CRITICAL threats.

Suggested fixes from the advisory include blocking at the HIGH threat level, treating single dangerous-category detections as sufficient to block, or implementing the documented "sanitize" action for HIGH-level threats.

Additionally, treat the regex detection set as advisory rather than the primary gate to improve defense against prompt injections.

Useful 0 Not Useful 0