CVE-2026-47391
Deferred Deferred - Pending Action

Unauthenticated Remote Code Execution in PraisonAI

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description
PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's first-party A2A server example exposes an unauthenticated A2A JSON-RPC endpoint and registers a `calculate(expression)` tool implemented with Python `eval()`. The example also binds to `0.0.0.0`. A remote unauthenticated attacker can send `message/send` to `/a2a`; the request reaches `agent.chat()`, and a real LLM can invoke the registered `calculate` tool. In testing with `gemini/gemini-2.5-flash-lite`, this resulted in arbitrary Python execution in the server process, confirmed by creation of a marker file from an unauthenticated HTTP request. The issue affects deployments following the official A2A example or similar unauthenticated public A2A deployments with unsafe tools. The default unauthenticated A2A surface also exposes task history and task cancellation APIs, increasing confidentiality and integrity impact. Version 4.6.40 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-23
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-47391
EUVD
EUVD-2026-46281

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mervinpraison praisonai 4.6.40

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-95 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in PraisonAI's A2A server example allows unauthenticated remote attackers to execute arbitrary Python code on the server. The issue occurs because the server exposes an unauthenticated A2A JSON-RPC endpoint, binds to all network interfaces, and includes a calculate() tool that uses Python's eval() to execute user-provided expressions. An attacker can send a crafted request to the /a2a endpoint, which the server passes to an LLM like Google's Gemini. The LLM then invokes the calculate() tool, leading to code execution via eval().

Detection Guidance

Check if your PraisonAI A2A server is exposed to the internet without authentication. Look for unauthenticated access to the /a2a endpoint on port 0.0.0.0. Test by sending a JSON-RPC request with a calculate tool using eval() payloads. Monitor for unexpected file creation or process execution.

Impact Analysis

This vulnerability can lead to full server compromise, allowing attackers to execute arbitrary code, access sensitive files, steal credentials, or cause denial of service. Attackers can create files on the server, exfiltrate data, or manipulate system operations. The impact is severe as it enables complete control over the affected system.

Compliance Impact

This vulnerability likely violates compliance requirements under GDPR and HIPAA due to unauthorized access to sensitive data, potential data breaches, and lack of proper authentication controls. It compromises confidentiality and integrity of data, leading to non-compliance with data protection regulations.

Mitigation Strategies

Upgrade PraisonAI to version 4.6.40 or later. Restrict access to the A2A endpoint by binding to localhost only. Remove or disable the calculate tool if it uses eval(). Ensure PLATFORM_ENV is explicitly set and PLATFORM_JWT_SECRET is configured with a strong random value.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47391. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart