Executive Summary

PraisonAI versions prior to 4.5.128 automatically load and execute a file named tools.py from the current working directory without explicit user consent, validation, or sandboxing.

This loading process uses importlib.util.spec_from_file_location and immediately runs the module-level code, even if tools.py is not referenced in configuration files or explicitly requested.

As a result, if an attacker can place a malicious tools.py file in the working directory where PraisonAI runs, arbitrary code execution will occur immediately upon startup.

This behavior breaks the expected security boundary between user-controlled project files and executable code, treating untrusted content as trusted and executing it automatically.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to execute arbitrary code on the system running PraisonAI simply by placing a malicious tools.py file in the working directory.

Such arbitrary code execution can lead to full compromise of the affected system, including unauthorized access, data theft, data modification, or disruption of services.

Because the code runs immediately upon startup, before any agent logic begins, it can bypass many security controls or detection mechanisms.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade PraisonAI to version 4.5.128 or later, where the issue is fixed.

Additionally, ensure that no untrusted tools.py files exist in the working directories where PraisonAI is run, as the presence of such a file triggers automatic code execution.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows arbitrary code execution by loading and executing untrusted code from a file named tools.py in the current working directory without user consent or validation.

Such arbitrary code execution can lead to exfiltration of environment variables and credentials, persistence on developer or CI systems, and unauthorized access to sensitive data.

These impacts can compromise the confidentiality, integrity, and availability of data, which are critical requirements under common standards and regulations like GDPR and HIPAA.

Therefore, exploitation of this vulnerability could result in non-compliance with these regulations due to potential unauthorized data access, data breaches, and failure to protect sensitive information.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if a file named tools.py exists in the current working directory where PraisonAI is executed, as its presence triggers automatic code execution.

To detect potential exploitation or presence of malicious tools.py files, you can list files named tools.py in directories where PraisonAI runs.

• Use the command: find /path/to/praisonai/projects -name tools.py
• Check for unexpected files created by malicious code, such as pwned.txt, which was used as a demonstration of exploitation.
• Monitor execution logs or run PraisonAI in a controlled environment to observe if any unexpected code executes upon startup.

Since the vulnerability involves automatic execution of tools.py without explicit user consent, auditing the working directories for untrusted or unexpected tools.py files is critical.

Useful 0 Not Useful 0