CVE-2026-44334

High

Description

PraisonAI is a multi-agent teams system. From version 4.5.139 to before version 4.6.32, CVE-2026-40287's fix gated tools.py auto-import behind PRAISONAI_ALLOW_LOCAL_TOOLS=true in two files (tool_resolver.py, api/call.py). A third import sink in praisonai/templates/tool_override.py was missed and remains unguarded. It is reached by the recipe runner on every recipe execution and is remotely triggerable through POST /v1/recipes/run with a recipe value pointing at any local absolute path or any GitHub repo (because SecurityConfig.allow_any_github defaults to True). The attacker drops a tools.py next to TEMPLATE.yaml; the server exec_module()s it. No auth required by default, no environment opt-in required. This issue has been patched in version 4.6.32.

SeverityHigh

CVSS8.4

Exploit probability—

ProductPraisonai

PublishedMay 8, 2026

First seenMay 8, 2026

Weakness typeCWE-94Code injection

How to fix

Update

praison praisonai4.6.32 or later
praisonai4.6.32 or later

Affected products

Product	Affected versions	Fixed in
praison praisonai	4.5.139 ≤ v < 4.6.32	4.6.32
praisonaiPyPI	4.5.139 ≤ v < 4.6.32	4.6.32

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.