Executive brief
PraisonAI is an AI agent framework used to automate tasks and workflows. A security vulnerability allows the software to automatically execute a specific Python file if it is present in the folder where the application is started. If an attacker can place a malicious file in that location, they can gain full control over the host system and access sensitive data.
Technical details
PraisonAI and praisonaiagents are vulnerable to arbitrary code execution via an untrusted search path (CWE-426) and code injection (CWE-94). The application automatically calls import_tools_from_file() and _load_local_tools() upon startup, which attempts to import a file named tools.py from the current working directory (./tools.py). An attacker with the ability to place a file in the process's working directory can achieve full code execution in the context of the PraisonAI process. This affects CLI tool-loading paths and workflow execution. The issue is fixed in PraisonAI version 4.5.139 and praisonaiagents version 1.5.140.
Affected products
- MervinPraison PraisonAI <= 4.5.138
- MervinPraison praisonaiagents <= 1.5.139
Timeline
- 2026-04-10: disclosed
- 2026-04-10: advisory
- 2026-04-10: patched: Fixed in PraisonAI 4.5.139 and praisonaiagents 1.5.140