CVE-2026-47398: PraisonAI RCE Vulnerability

CVE-2026-47398 Overview

PraisonAI is a multi-agent teams system that loads Python modules dynamically based on YAML configuration input. CVE-2026-47398 identifies an unguarded code execution flaw in versions prior to 4.6.40. The earlier v4.6.32 chokepoint refactor patched CVE-2026-44334 by adding the PRAISONAI_ALLOW_LOCAL_TOOLS environment variable gate to tool_override.py sinks. However, two additional spec.loader.exec_module call sites in praisonai/agents_generator.py were missed. Both functions accept a module_path parameter sourced from YAML configuration and execute it without validation, signature checking, or the env-var gate. Version 4.6.40 addresses the issue.

Critical Impact
Attackers who influence YAML configuration can execute arbitrary Python code in the PraisonAI process, resulting in full compromise of confidentiality, integrity, and availability.

Affected Products

PraisonAI versions prior to 4.6.40
PraisonAI v4.6.32 through v4.6.39 (chokepoint refactor incomplete)
Fixed in PraisonAI 4.6.40

Discovery Timeline

2026-07-21 - CVE-2026-47398 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-47398

Vulnerability Analysis

The flaw is a code injection weakness classified under [CWE-94]. PraisonAI's agent generator dynamically imports Python modules whose paths originate from YAML configuration files. The previous fix for CVE-2026-44334 introduced the PRAISONAI_ALLOW_LOCAL_TOOLS environment variable to gate module loading in tool_override.py. That refactor did not update all sinks. Two additional call sites in praisonai/agents_generator.py continue to invoke spec.loader.exec_module on attacker-controlled paths. The loader executes the target module's top-level statements immediately, giving arbitrary Python code execution inside the PraisonAI process.

Root Cause

The root cause is missing input validation and an incomplete security control. The module_path parameter flows from YAML configuration directly into importlib.util.spec_from_file_location followed by spec.loader.exec_module. No path allowlist, code signing check, or environment variable gate is applied at these two sites, so the earlier chokepoint refactor did not close the exposure.

Attack Vector

An attacker who can supply or modify a YAML agents configuration file consumed by PraisonAI can set module_path to a Python file under their control. When the agent generator processes the configuration, exec_module executes the file's statements with the privileges of the PraisonAI process. Because attack complexity is high, exploitation typically requires the attacker to place a file at a resolvable path or influence configuration ingestion.

python

# Related hardening from the same security batch (Pull Request #1685):
# examples/serve/mcp_http_server.py replaces raw eval() with an AST
# allowlist. The agents_generator.py fix in 4.6.40 similarly gates
# exec_module behind the PRAISONAI_ALLOW_LOCAL_TOOLS env variable.

def calculate(expression: str) -> str:
    """Calculate a math expression safely."""
    import ast
    allowed = set("0123456789+-*/.() ")
    if not all(c in allowed for c in expression):
        return "Error: Invalid expression"
    try:
        tree = ast.parse(expression, mode="eval")
        for node in ast.walk(tree):
            if not isinstance(
                node,
                (ast.Expression, ast.BinOp, ast.UnaryOp, ast.Constant,
                 ast.Add, ast.Sub, ast.Mult, ast.Div, ast.USub, ast.UAdd),
            ):
                return "Error: Invalid expression"
    except SyntaxError:
        return "Error: Invalid expression"

Source: GitHub Commit ef79b7a

Detection Methods for CVE-2026-47398

Indicators of Compromise

Unexpected Python files referenced by module_path fields in PraisonAI YAML configuration files.
PraisonAI process spawning child processes such as sh, bash, curl, or python interpreters loading untrusted files.
Outbound network connections from the PraisonAI process to unknown hosts shortly after agent initialization.

Detection Strategies

Audit all YAML configuration files consumed by PraisonAI for module_path values pointing outside a trusted, read-only directory.
Enable Python audit hooks (sys.addaudithook) to log importlib.load_dynamic and exec events from the PraisonAI process.
Compare deployed PraisonAI versions against 4.6.40 in software inventory to flag vulnerable installations.

Monitoring Recommendations

Monitor file system writes to directories referenced by PraisonAI YAML configurations, especially by non-administrative users.
Alert on new process ancestry originating from the PraisonAI worker that deviates from a known baseline.
Track access to and modifications of the PRAISONAI_ALLOW_LOCAL_TOOLS environment variable across deployment pipelines.

How to Mitigate CVE-2026-47398

Immediate Actions Required

Upgrade PraisonAI to version 4.6.40 or later, which extends the env-var gate to both spec.loader.exec_module call sites in agents_generator.py.
Restrict write access to YAML agent configuration files to trusted administrators only.
Ensure PRAISONAI_ALLOW_LOCAL_TOOLS is unset in production unless local tool loading is explicitly required.

Patch Information

The fix is delivered in PraisonAI 4.6.40 via GitHub Pull Request #1685 and commit ef79b7a. Coordination details are documented in GitHub Security Advisory GHSA-78r8-wwqv-r299.

Workarounds

Run PraisonAI under a dedicated, low-privilege service account with no write access to its own installation directory.
Load YAML configurations only from a signed, read-only source such as a versioned artifact repository.
Deploy PraisonAI inside a container with a read-only root filesystem and outbound network egress restrictions.

bash

# Upgrade to the patched release and confirm the env-var gate is disabled
pip install --upgrade "praisonai>=4.6.40"
unset PRAISONAI_ALLOW_LOCAL_TOOLS
python -c "import praisonai, sys; print(praisonai.__version__)"