CVE-2026-40156 Details
Description
PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI automatically loads a file named tools.py from the current working directory to discover and register custom agent tools. This loading process uses importlib.util.spec_from_file_location and immediately executes module-level code via spec.loader.exec_module() without explicit user consent, validation, or sandboxing. The tools.py file is loaded implicitly, even when it is not referenced in configuration files or explicitly requested by the user. As a result, merely placing a file named tools.py in the working directory is sufficient to trigger code execution. This behavior violates the expected security boundary between user-controlled project files (e.g., YAML configurations) and executable code, as untrusted content in the working directory is treated as trusted and executed automatically. If an attacker can place a malicious tools.py file into a directory where a user or automated system (e.g., CI/CD pipeline) runs praisonai, arbitrary code execution occurs immediately upon startup, before any agent logic begins. This vulnerability is fixed in 4.5.128.
A vulnerability in PraisonAI versions prior to 4.5.128 allows for arbitrary code execution by automatically loading a file named tools.py from the current working directory. This process, which uses importlib to execute module-level code, occurs without user consent or validation, and is not sandboxed. The tools.py file is loaded implicitly, even if not referenced in configuration files. This behavior creates a security risk by treating untrusted content as trusted and executing it automatically. If a malicious tools.py file is placed in a directory where PraisonAI is run, the code will be executed immediately upon startup, before any agent logic is processed. This vulnerability is particularly concerning in environments like CI/CD pipelines, where untrusted repositories may be processed.
Users are advised to update to PraisonAI version 4.5.128 or later. Additionally, consider implementing measures such as requiring explicit opt-in for loading tools.py, adding pre-execution user confirmations, restricting trusted paths, avoiding the execution of module-level code during tool discovery, and optionally hardening the execution environment.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-2g3w-cpc4-chr4 | CISA-ADP | Vendor Advisory |
| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-2g3w-cpc4-chr4 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-426 | Untrusted Search Path | [email protected] |
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| praison praisonai | < 4.5.128 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 20, 2026 | Initial Analysis | [email protected] |
| Apr 13, 2026 | CVE Modified | CISA-ADP |
| Apr 10, 2026 | New CVE Received | [email protected] |