Executive brief
PraisonAI, a framework for building AI agents, contains a flaw in how it identifies and runs tools. An attacker who can influence the name of a tool being called can trick the system into executing internal functions that were never intended to be accessible. This could allow an unauthorized user to trigger sensitive operations, access internal data, or execute arbitrary code depending on the functions available in the application's memory.
Technical details
The vulnerability exists in the `ToolExecutionMixin.execute_tool` method within `praisonaiagents`. When a tool name is requested that does not match a declared tool or a registry entry, the code falls back to searching `globals()` and the `__main__` module. Because the default agent configuration sets `_perm_allow` to `None` (effectively an 'allow all' policy), any callable found in these scopes can be executed with attacker-supplied arguments. This allows for the invocation of unintended application callables, potentially leading to remote code execution or unauthorized state changes if privileged helper functions are present in the process scope. The issue is fixed in versions 4.6.37 (PraisonAI) and 1.6.37 (praisonaiagents).
Affected products
- MervinPraison PraisonAI <= 4.6.36
- MervinPraison praisonaiagents <= 1.6.36
Timeline
- 2026-05-08: kev added: NVD published date
- 2026-05-11: advisory: GitHub Advisory published