Executive brief
PraisonAI, an AI agent framework, contains a security flaw that allows an unauthenticated attacker to execute arbitrary code on the server. By sending a specially crafted request to the recipe execution endpoint, an attacker can force the system to download and run malicious Python code from a remote GitHub repository or a local path. This could lead to a full system takeover, unauthorized data access, or disruption of services.
Technical details
A remote code execution (RCE) vulnerability exists in PraisonAI due to an improper control of code generation (CWE-94) in `praisonai/templates/tool_override.py`. While CVE-2026-40287 introduced an environment variable gate (`PRAISONAI_ALLOW_LOCAL_TOOLS`) to prevent automatic loading of `tools.py`, this specific file was overlooked. An attacker can trigger the vulnerability by sending a POST request to `/v1/recipes/run` with a `recipe` parameter pointing to a malicious GitHub repository or local absolute path. The application uses `spec.loader.exec_module()` to load `tools.py` from the provided recipe directory without authentication or signature verification. This allows for arbitrary Python code execution within the context of the server process. The issue is patched in version 4.6.32.
Affected products
- MervinPraison praisonai >= 4.5.139, <= 4.6.31
Timeline
- 2026-04-25: other: Vulnerability confirmed on version 4.6.31
- 2026-04-29: disclosed
- 2026-05-06: advisory
- 2026-05-08: other: NVD published CVE-2026-44334