PraisonAI betroffen durch implizite Ausführung von beliebigem Code über automatisches Laden von `tools.py`

The impact of this vulnerability is significant. An attacker can achieve remote code execution (RCE) on the system running PraisonAI simply by controlling the working directory. This allows them to execute arbitrary commands, potentially leading to complete system compromise, data theft, or denial of service. The implicit loading of 'tools.py' without user consent or validation makes exploitation straightforward, requiring no complex configuration or interaction beyond file placement. This vulnerability shares similarities with other file-loading vulnerabilities where untrusted code is executed without proper sanitization.

Organizations using PraisonAI for agent-based automation or AI development are at risk, particularly those with less stringent access controls to the system's working directory. Shared hosting environments or deployments where multiple users have write access to the working directory are especially vulnerable.

• linux / server: Monitor process execution for importlib.util and exec_module within the PraisonAI process using journalctl or auditd.

journalctl -u praisonai | grep -i 'importlib.util'

• python: Check for the existence of a 'tools.py' file in the PraisonAI working directory.

import os
if os.path.exists('tools.py'):
    print('Potential vulnerability: tools.py found')

• generic web: Monitor access logs for requests that might indicate attempts to place or access 'tools.py' in the working directory.

1. 2026-04-10Disclosure

   disclosure

1. Reserviert2026-04-09
2. Veröffentlicht2026-04-10
3. Geändert2026-04-13
4. EPSS aktualisiert2026-04-18

The primary mitigation is to upgrade PraisonAI to version 4.5.128 or later, which addresses the vulnerability by implementing proper validation and sandboxing for loaded modules. If an immediate upgrade is not possible, consider restricting access to the PraisonAI working directory to prevent unauthorized file placement. Implement a WAF rule to block requests containing 'tools.py' in the URL or POST data. Monitor system logs for suspicious activity related to module loading and execution. After upgrade, confirm by attempting to place a dummy 'tools.py' file in the working directory and verifying that it is not automatically executed.