Threat
PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats | GitLab Advisory Database (GLAD)
Publication date unknown · Discovered gitlab.com
Page published
Publication date unknown · First observed: 12 Oct 2026
Coverage timeline
Single-source advisory — one report is available.
Why it matters
PraisonAI's prompt injection defense ships misconfigured by default, giving developers a false sense of protection while HIGH-level injection attacks pass through unblocked.
CVE-2026-61439 affects PraisonAI's Injection Defense layer, whose block threshold defaults to Threat Level CRITICAL — reached only when 3+ detection checks fire simultaneously. A single-check match on dangerous categories like instruction override or financial manipulation produces only a HIGH-severity result that is logged but never blocked, allowing prompt injections to bypass the defense.