CVE-2026-47391 Details
Description
PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's first-party A2A server example exposes an unauthenticated A2A JSON-RPC endpoint and registers a `calculate(expression)` tool implemented with Python `eval()`. The example also binds to `0.0.0.0`. A remote unauthenticated attacker can send `message/send` to `/a2a`; the request reaches `agent.chat()`, and a real LLM can invoke the registered `calculate` tool. In testing with `gemini/gemini-2.5-flash-lite`, this resulted in arbitrary Python execution in the server process, confirmed by creation of a marker file from an unauthenticated HTTP request. The issue affects deployments following the official A2A example or similar unauthenticated public A2A deployments with unsafe tools. The default unauthenticated A2A surface also exposes task history and task cancellation APIs, increasing confidentiality and integrity impact. Version 4.6.40 patches the issue.
A critical vulnerability exists in PraisonAI's first-party A2A server example, prior to version 4.6.40. The server exposes an unauthenticated A2A JSON-RPC endpoint and registers a 'calculate(expression)' tool that executes Python code using 'eval()'. This example binds to '0.0.0.0', allowing remote access. An unauthenticated attacker can send a message that reaches 'agent.chat()', prompting a real LLM to invoke the 'calculate' tool. Testing with 'gemini/gemini-2.5-flash-lite' demonstrated arbitrary Python execution on the server, verified by the creation of a marker file from an unauthenticated HTTP request. This vulnerability affects deployments that follow the official A2A example or similar unauthenticated public A2A deployments with unsafe tools.
Users are advised to update to PraisonAI version 4.6.40 or later, where this vulnerability has been patched. Additionally, review and modify any A2A server deployments to ensure they are not exposing unsafe tools or endpoints without proper authentication.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 21, 2026CISA-ADP
Assessed Jul 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vg22-4gmj-prxw | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/MervinPraison/PraisonAI/commit/e0fb8e7dd1ee6759c18ed07f436c21dbd9c20747 | [email protected] | Source CodeVendor |
| https://github.com/MervinPraison/PraisonAI/pull/1793 | [email protected] | Issue TrackingVendor |
| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vg22-4gmj-prxw | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-95 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| PraisonAI | <= 4.6.39 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Modified | CISA-ADP |
| Jul 21, 2026 | New CVE Received | [email protected] |