CVE-2026-47398 Details
Description
PraisonAI is a multi-agent teams system. The v4.6.32 chokepoint refactor (which patched CVE-2026-44334 / GHSA-xcmw-grxf-wjhj) added the PRAISONAI_ALLOW_LOCAL_TOOLS env-var gate to the tool_override.py sinks. However, two additional spec.loader.exec_module call sites in praisonai/agents_generator.py were missed and remain completely unguarded in versions prior to 4.6.40. Both functions accept a module_path parameter sourced from YAML configuration and execute it without validation, signature checking, or the env-var gate. Version 4.6.40 fixes the issue.
A vulnerability in PraisonAI versions through 4.6.39 allows arbitrary code execution via ungated calls to 'spec.loader.exec_module' in the 'agents_generator.py' file. This issue arises because the 'PRAISONAI_ALLOW_LOCAL_TOOLS' environment variable is not checked, leaving two execution points exposed. The 'module_path' parameter, which is sourced from YAML configuration, can be manipulated to execute malicious code without validation or signature checks. This vulnerability was introduced in the 4.6.32 chokepoint refactor, which added the environment variable gate to other parts of the application but missed these critical points in the agents generator.
Users can update to PraisonAI version 4.6.40 or later, where this vulnerability has been fixed. The patch applies the necessary environment variable checks and validates the 'module_path' against an allowlist of expected locations.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 21, 2026CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-78r8-wwqv-r299 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/MervinPraison/PraisonAI/commit/ef79b7a0561796ad9807f0f09538c25cc78d3619 | [email protected] | Source CodeVendor |
| https://github.com/MervinPraison/PraisonAI/pull/1685 | [email protected] | Issue TrackingVendor |
| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-78r8-wwqv-r299 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| PraisonAI | <= 4.6.39 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | New CVE Received | [email protected] |
| Jul 21, 2026 | CVE Modified | CISA-ADP |