CVE-2026-61437 — PraisonAI before 1.6.78 Remote Code Execution via tools.py

Affected: MervinPraison PraisonAI

PraisonAI (pip package praisonaiagents) before 1.6.78 contains an unsafe dynamic module loading vulnerability in AgentFlow._resolve_pydantic_class (src/praisonai-agents/praisonaiagents/workflows/workflows.py). When a workflow step uses a string output_pydantic reference, the framework locates and imports a sibling tools.py from the workflow file's directory via importlib exec_module without sandboxing, ignoring the PRAISONAI_ALLOW_*_TOOLS environment variables. An attacker who controls a workflow file and its sibling tools.py can execute arbitrary Python code with the workflow runner's privileges when the workflow is executed via WorkflowManager or after load_yaml.

PYSEC-2026-4267 — PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow

Affected: PyPI: praisonaiagents

### Summary An unsafe dynamic module loading vulnerability allows an attacker who can control a workflow file and a sibling `tools.py` to execute arbitrary Python code when the workflow is executed.

### Details The vulnerability is located in the workflow structured output resolution logic.

File: src/praisonai-agents/praisonaiagents/workflows/workflows.py

Method: AgentFlow._resolve_pydantic_class

```python if self.file_path: workflow_dir = Path(self.file_path).parent tools_path = workflow_dir / "tools.py"

if tools_path.exists(): spec = importlib.util.spec_from_file_location("tools", tools_path) tools_module = importlib.util.module_from_spec(spec) spec.loader.exec_module(tools_module) # Arbitrary code execution ```

This code is reached during step execution when a step uses a string `output_pydantic`:

```python step_output_pydantic = getattr(step, '_output_pydantic', None) if step_output_pydantic and isinstance(step_output_pydantic, str): resolved_class = self._resolve_pydantic_class(step_output_pydantic) ```

`file_path` is set automatically by: - `WorkflowManager._load_workflow()` (used by workspace discovery) - `WorkflowManager.create_workflow()`

It can also be set manually after `load_yaml()`: ```python wf = mgr.load_yaml("workflow.yaml") wf.file_path = "workflow.yaml" ```

The `exec_module()` call has no sandboxing and ignores the `PRAISONAI_ALLOW_*_TOOLS` environment variables used elsewhere in the project.

### PoC Cre…

Most recent entries from all

CVE-2026-61437 — PraisonAI before 1.6.78 Remote Code Execution via tools.py

PYSEC-2026-4267 — PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow