Unsafe Dynamic Module Loading in PraisonAI

Executive Summary

CVE-2026-61437 is a high-severity vulnerability in PraisonAI (pip package praisonaiagents) versions before 1.6.78. It involves unsafe dynamic module loading in the AgentFlow._resolve_pydantic_class function. When a workflow step uses a string output_pydantic reference, the framework automatically locates and imports a sibling tools.py file from the workflow directory using importlib.exec_module without sandboxing or respecting environment variable restrictions.

An attacker who controls both the workflow file and its sibling tools.py file can execute arbitrary Python code with the privileges of the workflow runner when the workflow is executed via WorkflowManager or after load_yaml.

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability allows an attacker to execute arbitrary Python code with the workflow runner's privileges. This can lead to several impacts including reading local files, accessing process secrets, modifying workflow behavior, performing network operations, or executing system commands.

The attack vector is local, requires low complexity, no privileges, and user interaction. Users running workflows from untrusted sources such as repositories, templates, or CI/CD artifacts are at risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker to execute arbitrary Python code with the privileges of the workflow runner by controlling a workflow file and its sibling tools.py file. Successful exploitation can lead to reading local files, accessing process secrets, modifying workflow behavior, performing network operations, or executing system commands.

Such unauthorized access and control over sensitive data and system operations can lead to violations of data protection regulations and standards like GDPR and HIPAA, which require strict controls over data confidentiality, integrity, and access.

Therefore, organizations using affected versions of PraisonAI may face compliance risks if this vulnerability is exploited, as it could result in unauthorized disclosure or alteration of protected data.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability occurs when a workflow step uses a string output_pydantic reference that causes the framework to import and execute a sibling tools.py file without sandboxing. Detection involves identifying if any workflow files and their sibling tools.py files are controlled by untrusted sources or contain suspicious code.

You can inspect your workflow directories for the presence of tools.py files alongside workflow files and review their contents for unauthorized or suspicious code.

Suggested commands to detect potentially malicious tools.py files or suspicious workflow files include:

• Find all tools.py files in your workflow directories: `find /path/to/workflows -name tools.py`
• Check for recent modifications or unexpected changes: `find /path/to/workflows -name tools.py -exec ls -l {} \;` or `git diff` if using version control
• Search for suspicious imports or code patterns in tools.py files: `grep -r --include=tools.py 'importlib.exec_module' /path/to/workflows` or `grep -r --include=tools.py 'exec' /path/to/workflows`

Monitoring workflow execution logs for unexpected behavior or errors related to module loading may also help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade PraisonAI to version 1.6.78 or later, where this unsafe dynamic module loading vulnerability has been fixed.

Until an upgrade is possible, avoid executing workflows from untrusted sources or repositories, especially those that include a sibling tools.py file.

Restrict or sandbox the environment where workflows are executed to limit the privileges of the workflow runner and prevent arbitrary code execution.

Review and audit existing workflow directories for unauthorized or suspicious tools.py files and remove or quarantine them.

Consider implementing additional monitoring and alerting on workflow executions to detect unusual activity.

Useful 0 Not Useful 0