CVE-2026-44339: PraisonAI unsafe tool resolution in ToolExecutionMixin

CVE-2026-44339 · Severity: high · CVSS 8.6 · Published 2026-05-08

PraisonAI, a framework for building AI agents, contains a flaw in how it identifies and runs tools. An attacker who can influence the name of a tool being called can trick the system into executing internal functions that were never intended to be accessible. This could allow an unauthorized user to trigger sensitive operations, access internal data, or execute arbitrary code depending on the functions available in the application's memory.

Technologies: Praisonai, Praisonaiagents, praisonai (PyPI), praisonaiagents (PyPI). Vendors: Praison, PyPI.

Quick answers

Is CVE-2026-44339 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44339 being exploited in the wild.
How severe is CVE-2026-44339?
High severity, with a CVSS score of 8.6, published 8 May 2026.
Which products and versions are affected?
praisonai (PyPI) ECOSYSTEM:introduced=0,fixed=4.6.37; praisonaiagents (PyPI) ECOSYSTEM:introduced=0,fixed=1.6.37.
Is there a fix for CVE-2026-44339?
Yes. praisonai (PyPI): upgrade to 4.6.37 or later; praisonaiagents (PyPI): upgrade to 1.6.37 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44339 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-44339?
Check whether you run Praisonai, Praisonaiagents, praisonai (PyPI) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • praisonai (PyPI): upgrade to 4.6.37 or later
    pip install "praisonai>=4.6.37"
  • praisonaiagents (PyPI): upgrade to 1.6.37 or later
    pip install "praisonaiagents>=1.6.37"

Technical details

The vulnerability exists in the `ToolExecutionMixin.execute_tool` method within `praisonaiagents`. When a tool name is requested that does not match a declared tool or a registry entry, the code falls back to searching `globals()` and the `__main__` module. Because the default agent configuration sets `_perm_allow` to `None` (effectively an 'allow all' policy), any callable found in these scopes can be executed with attacker-supplied arguments. This allows for the invocation of unintended application callables, potentially leading to remote code execution or unauthorized state changes if privileged helper functions are present in the process scope. The issue is fixed in versions 4.6.37 (PraisonAI) and 1.6.37 (praisonaiagents).

Affected products

  • MervinPraison PraisonAI <= 4.6.36
  • MervinPraison praisonaiagents <= 1.6.36

Identifiers

  • CVE-2026-44339
  • GHSA-gmjg-hv98-qggq
  • PYSEC-2026-2915
  • PYSEC-2026-2948

Timeline

  • 2026-05-08: kev added: NVD published date
  • 2026-05-11: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.