CVE-2026-44334: Praison Praisonai RCE Vulnerability

CVE-2026-44334 Overview

CVE-2026-44334 is a code injection vulnerability [CWE-94] in PraisonAI, a multi-agent teams system. The flaw affects versions 4.5.139 through 4.6.31. An earlier fix for CVE-2026-40287 gated tools.py auto-import behind the PRAISONAI_ALLOW_LOCAL_TOOLS=true environment variable in tool_resolver.py and api/call.py. A third import sink in praisonai/templates/tool_override.py was missed and remains unguarded. The recipe runner reaches this sink on every recipe execution. Attackers can trigger it remotely via POST /v1/recipes/run by pointing the recipe value at any local absolute path or GitHub repository, because SecurityConfig.allow_any_github defaults to True.

Critical Impact
Unauthenticated attackers can achieve arbitrary code execution by dropping a malicious tools.py next to TEMPLATE.yaml, which the server then loads via exec_module().

Affected Products

PraisonAI versions 4.5.139 through 4.6.31
Deployments exposing the /v1/recipes/run API endpoint
Instances relying on default SecurityConfig.allow_any_github=True

Discovery Timeline

2026-05-08 - CVE-2026-44334 published to NVD
2026-05-08 - Last updated in NVD database

Technical Details for CVE-2026-44334

Vulnerability Analysis

The vulnerability stems from an incomplete remediation of CVE-2026-40287. The original fix introduced an environment variable gate, PRAISONAI_ALLOW_LOCAL_TOOLS, to restrict automatic loading of tools.py files alongside recipe templates. The fix applied this gate to tool_resolver.py and api/call.py. However, praisonai/templates/tool_override.py contains a third import sink that was overlooked. This sink imports user-supplied Python modules without checking the opt-in flag.

The recipe runner invokes this code path on every recipe execution. The POST /v1/recipes/run endpoint accepts a recipe parameter referencing either a local absolute path or a GitHub repository URL. The server fetches the referenced repository or reads the local directory, then loads any adjacent tools.py file using Python's exec_module(). No authentication is required by default. No environment opt-in is required to reach the vulnerable code path.

Root Cause

The root cause is an incomplete security control. The patch for CVE-2026-40287 missed an additional import location in the template override module. The CWE-94 classification reflects improper control of code generation, where untrusted Python source is executed as part of normal application flow.

Attack Vector

An attacker hosts a public GitHub repository containing a TEMPLATE.yaml file and a malicious tools.py file. The attacker sends a POST request to /v1/recipes/run with the recipe field set to the repository URL. The PraisonAI server clones the repository and executes the recipe. During execution, tool_override.py imports tools.py, invoking exec_module() on attacker-controlled Python code. The attacker gains code execution in the context of the PraisonAI process.

// Exploitation flow (described in prose - no verified PoC code available)
// 1. Attacker creates GitHub repo with TEMPLATE.yaml + malicious tools.py
// 2. POST /v1/recipes/run { "recipe": "https://github.com/attacker/repo" }
// 3. Server fetches repo, recipe runner invokes tool_override.py
// 4. Unguarded import sink calls exec_module() on tools.py
// 5. Arbitrary Python executes in server context

Detection Methods for CVE-2026-44334

Indicators of Compromise

Unexpected outbound connections from PraisonAI hosts to GitHub repositories not authorized by the organization
Presence of unfamiliar tools.py files in recipe template directories
Process spawns from the PraisonAI service account that deviate from baseline behavior
Access log entries for POST /v1/recipes/run referencing external or untrusted recipe sources

Detection Strategies

Inspect web server and reverse proxy logs for POST /v1/recipes/run requests with recipe values containing absolute filesystem paths or arbitrary GitHub URLs
Monitor for child processes spawned by the PraisonAI runtime that perform network connections, shell execution, or filesystem modification outside expected recipe behavior
Audit recipe template directories for newly written tools.py files and compare hashes against known-good templates

Monitoring Recommendations

Enable application-level logging that captures the full recipe argument for every /v1/recipes/run invocation
Forward PraisonAI host telemetry to a centralized data lake for correlation between HTTP requests and subsequent process activity
Alert on any invocation of importlib or exec_module paths originating from tool_override.py if instrumentation is available

How to Mitigate CVE-2026-44334

Immediate Actions Required

Upgrade PraisonAI to version 4.6.32 or later, which closes the unguarded import sink in tool_override.py
Restrict network access to the /v1/recipes/run endpoint until the upgrade is complete
Set SecurityConfig.allow_any_github to False to prevent loading recipes from arbitrary GitHub repositories
Enforce authentication on the PraisonAI API surface; the default configuration requires no authentication

Patch Information

The maintainers patched this issue in PraisonAI version 4.6.32. The fix extends the PRAISONAI_ALLOW_LOCAL_TOOLS gate to the third import sink in praisonai/templates/tool_override.py. See the GitHub Security Advisory GHSA-xcmw-grxf-wjhj for full details.

Workarounds

Place PraisonAI behind a reverse proxy that requires authentication and blocks external access to /v1/recipes/run
Restrict recipe sources to a maintained allowlist of internal Git repositories by overriding SecurityConfig.allow_any_github
Run the PraisonAI service under a low-privilege account with no write access to sensitive paths and no outbound network egress beyond required dependencies

bash

# Configuration example - upgrade and restrict recipe sources
pip install --upgrade 'praisonai>=4.6.32'

# Disable arbitrary GitHub recipe loading in SecurityConfig
export PRAISONAI_ALLOW_ANY_GITHUB=false
export PRAISONAI_ALLOW_LOCAL_TOOLS=false