[ CVE-2026-61437 · Published 10 Jul 2026 ]
PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow
CVSS 7.8
EPSS <1%Fix available
[ Why it matters ]Priority signals
- Public proof-of-concept exploit exists (CISA SSVC)
[ Description ]Official description
PraisonAI (pip package praisonaiagents) before 1.6.78 contains an unsafe dynamic module loading vulnerability in AgentFlow._resolve_pydantic_class (src/praisonai-agents/praisonaiagents/workflows/workflows.py). When a workflow step uses a string output_pydantic reference, the framework locates and imports a sibling tools.py from the workflow file's directory via importlib exec_module without sandboxing, ignoring the PRAISONAI_ALLOW_*_TOOLS environment variables. An attacker who controls a workflow file and its sibling tools.py can execute arbitrary Python code with the workflow runner's privileges when the workflow is executed via WorkflowManager or after load_yaml.
[ Fixes ]Fixes and patches
- praisonaiagents 1.6.78Fixed version · GitHub Advisories · pip package praisonaiagents: upgrade to 1.6.78 or later (affected <= 1.6.77)
[ Packages ]Affected open-source packages
- praisonaiagents pipAffected <= 1.6.77 · fixed in 1.6.78 · GHSA-4gfv-wg42-7jw5