Executive brief
PraisonAI, a framework for AI agents, contains a security flaw in how it handles plugins. The software automatically searches for and runs any Python files found in specific plugin folders without checking if they are safe or authentic. If an attacker manages to place a malicious file in one of these folders—perhaps through a separate software bug or a supply chain attack—they can take full control of the system whenever the AI framework starts.
Technical details
A code injection vulnerability exists in the PraisonAI plugin manager due to improper control of code generation (CWE-94) and uncontrolled search path elements (CWE-427). The `manager.py` and `discovery.py` components use `importlib.util.spec_from_file_location()` and `exec_module()` to load plugins from `~/.praisonai/plugins/` and project-level directories without code signing, integrity verification, or sandboxing. An attacker who can write a .py file to these locations (e.g., via path traversal or a compromised dependency) achieves arbitrary code execution at framework initialization. The vulnerability is addressed in version 1.6.78.
Affected products
- MervinPraison PraisonAI (praisonaiagents) < 1.6.78
Timeline
- 2026-06-25: advisory: GitHub Security Advisory published by vendor
- 2026-07-15: disclosed: CVE published to NVD dataset
- 2026-07-15: patched: Fix confirmed in version 1.6.78