Executive brief
PraisonAI, a tool for managing AI agents, automatically executes code from a file named 'tools.py' if it is present in the current folder when the application starts. An attacker could trick a user into downloading a malicious project folder or submitting a malicious file to a shared environment, leading to full control over the user's system or CI/CD pipeline. This poses a significant risk to developers and automated systems that process untrusted project files.
Technical details
PraisonAI's ToolResolver component automatically searches for and loads a file named 'tools.py' from the current working directory (CWD) to register custom agent tools. The vulnerability exists in `src/praisonai/praisonai/tool_resolver.py` within the `_load_local_tools` method, which uses `importlib.util.spec_from_file_location` and `spec.loader.exec_module()` to import the file. Because this occurs implicitly upon startup without validation or explicit user opt-in, any code at the module level of a malicious 'tools.py' file will execute with the privileges of the PraisonAI process. This can be exploited via social engineering (e.g., malicious repository templates) or in shared environments like CI/CD pipelines. The issue is fixed in version 4.5.128.
Affected products
- MervinPraison praisonai < 4.5.128
Timeline
- 2026-04-09: disclosed: Vulnerability published by MervinPraison
- 2026-04-10: advisory: GitHub Advisory published and reviewed
- 2026-04-10: patched: Fix released in version 4.5.128