Read the docs
TI-2026-40068 Aliases CVE-2026-55522GHSA-hxmv-c4g6-5fqc

PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code

Priority HIGH 69CWE-426Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-426.

Summary

PraisonAI is a multi-agent teams system. In versions 3.9.26 through 4.6.57 of praiseonai and 0.12.12 through 1.6.57 of praiseonaiagents, the workflow "include" feature is vulnerable to code execution. Workflow._execute_include() implicitly imports and runs an included recipe's tools.py via a raw importlib.util.spec_from_file_location() and spec.loader.exec_module() call, without honoring the PRAISONAI_ALLOW_TEMPLATE_TOOLS/PRAISONAI_ALLOW_LOCAL_TOOLS autoload opt-in gates or routing through the centralized safe loader that protects the other tools.py autoload paths. As a result, a workflow that includes an attacker-controlled local recipe directory executes arbitrary module-level Python code during include setup, before any child workflow parsing or model call, and the same sink is reachable through the higher-level praisonai.recipe.run() recipe API. An attacker who can cause a victim process to run a workflow or recipe that includes an untrusted local recipe achieves arbitrary Python code execution as the PraisonAI process user, a variant that bypasses the hardening applied to the previously disclosed automatic tools.py RCE advisory family. This issue has been fixed in version 4.6.58 of praisonai and 1.6.58 of praisonaiagents.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00224 13th percentileScored 2026-11-07
Fix Fixed PraisonAI (MervinPraison): 4.6.58praisonaiagents (MervinPraison): 1.6.58+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MervinPraisonPraisonAI3.9.26 to before 4.6.584.6.58Patch availableCNA
MervinPraisonpraisonaiagents0.12.12 to before 1.6.581.6.58Patch availableCNA
—praisonaiagents (PyPI)0.12.12 to before 1.6.581.6.58Patch availableGHSA-hxmv-c4g6-5fqc
—PraisonAI (PyPI)3.9.26 to before 4.6.584.6.58Patch availableGHSA-hxmv-c4g6-5fqc
  • PraisonAI VendorMervinPraison Affected 3.9.26 to before 4.6.58 Fixed in 4.6.58 Patch available CNA
  • praisonaiagents VendorMervinPraison Affected 0.12.12 to before 1.6.58 Fixed in 1.6.58 Patch available CNA
  • praisonaiagents (PyPI) Vendor— Affected 0.12.12 to before 1.6.58 Fixed in 1.6.58 Patch available GHSA-hxmv-c4g6-5fqc
  • PraisonAI (PyPI) Vendor— Affected 3.9.26 to before 4.6.58 Fixed in 4.6.58 Patch available GHSA-hxmv-c4g6-5fqc

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:*——MervinPraison
  • cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:* Versions — — ·MervinPraison

Remediation

  • Fix · CNA PraisonAI (MervinPraison) Fixed in 4.6.58
  • Fix · CNA praisonaiagents (MervinPraison) Fixed in 1.6.58
  • Fix · GHSA-hxmv-c4g6-5fqc praisonaiagents (PyPI) Fixed in 1.6.58 Advisory →
  • Fix · GHSA-hxmv-c4g6-5fqc PraisonAI (PyPI) Fixed in 4.6.58 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55522
  2. 2026-10-03 Alias added: GHSA-hxmv-c4g6-5fqc

References

Advisory 1

Other 4

  • TI-2026-79619 Missing authentication in PraisonAI AgentOS exposes agent chat CVSS 3.1CRITICAL 9.8
  • TI-2026-71236 Missing access control in PraisonAI AgentTeam exposes agent endpoints CVSS 3.1CRITICAL 9.8
  • TI-2026-44052 PraisonAI before 1.6.78 Remote Code Execution via CodeAgent CVSS 4.0CRITICAL 10.0
  • TI-2026-41123 praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard) CVSS 3.1CRITICAL 9.8
  • TI-2026-41122 praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery CVSS 3.1CRITICAL 9.8
  • TI-2026-41118 PraisonAI MCPServer exposes unauthenticated HTTP tools/call CVSS 3.1CRITICAL 9.8
See all 177 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences