CVE-2026-47398
Received Received - Intake

Arbitrary Code Execution in PraisonAI via Unsafe Module Loading

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description
PraisonAI is a multi-agent teams system. The v4.6.32 chokepoint refactor (which patched CVE-2026-44334 / GHSA-xcmw-grxf-wjhj) added the PRAISONAI_ALLOW_LOCAL_TOOLS env-var gate to the tool_override.py sinks. However, two additional spec.loader.exec_module call sites in praisonai/agents_generator.py were missed and remain completely unguarded in versions prior to 4.6.40. Both functions accept a module_path parameter sourced from YAML configuration and execute it without validation, signature checking, or the env-var gate. Version 4.6.40 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-21
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-47398
EUVD
EUVD-2026-46306

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
praisonai praisonai to 4.6.40 (exc)
mervinpraison praisonai From 4.6.40 (exc)
mervinpraison praisonai to 4.6.37 (inc)
mervinpraison praisonai to 4.6.40 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-829 The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

PraisonAI versions prior to 4.6.40 have an unpatched vulnerability where two functions in praisonai/agents_generator.py execute module paths from YAML configuration without validation or security checks. These functions use spec.loader.exec_module to run code directly from user-provided paths, allowing arbitrary code execution.

Detection Guidance

To detect this vulnerability, inspect PraisonAI configurations for unvalidated module paths in YAML files. Check for usage of load_tools_from_module or load_tools_from_module_class functions in agents_generator.py. Verify if PRAISONAI_ALLOW_LOCAL_TOOLS is set and properly gating these calls. Monitor for unexpected module executions or unauthorized code runs.

Impact Analysis

An attacker could exploit this to run malicious code on your system by tricking you into loading a crafted YAML configuration file. This could lead to full system compromise, data theft, or unauthorized actions depending on the permissions of the PraisonAI process.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements. Organizations may face compliance violations if exploited, resulting in fines or legal consequences.

Mitigation Strategies

Upgrade PraisonAI to version 4.6.40 or later to address the unguarded module execution paths in praisonai/agents_generator.py.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47398. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart