CVE-2026-55522: PraisonAI Workflow Include RCE Vulnerability

CVE-2026-55522 Overview

CVE-2026-55522 is an arbitrary code execution vulnerability in PraisonAI, a multi-agent teams system. The flaw affects praisonai versions 3.9.26 through 4.6.57 and praisonaiagents versions 0.12.12 through 1.6.57. The workflow include feature loads a referenced recipe's tools.py through raw importlib calls, bypassing the safe loader that guards other autoload paths. An attacker who convinces a victim process to run a workflow or recipe that includes an untrusted local recipe directory achieves arbitrary Python code execution as the PraisonAI process user. The issue is tracked as CWE-94: Improper Control of Generation of Code.

Critical Impact
Arbitrary Python code execution runs during include setup before any workflow parsing or model call, giving attackers full control of the PraisonAI process user context.

Affected Products

praisonai versions 3.9.26 through 4.6.57
praisonaiagents versions 0.12.12 through 1.6.57
Any application invoking praisonai.recipe.run() with untrusted local recipe paths

Discovery Timeline

2026-08-05 - CVE-2026-55522 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-55522

Vulnerability Analysis

The vulnerability resides in Workflow._execute_include(), which handles the workflow include feature. This function implicitly imports and executes an included recipe's tools.py by calling importlib.util.spec_from_file_location() followed by spec.loader.exec_module(). The import happens as a raw operation. It does not route through the centralized safe loader that protects other tools.py autoload paths in PraisonAI.

The raw loader also ignores the PRAISONAI_ALLOW_TEMPLATE_TOOLS and PRAISONAI_ALLOW_LOCAL_TOOLS environment gates. These gates were introduced to require explicit opt-in before local tool modules execute. Because _execute_include() bypasses them, module-level Python code in tools.py runs unconditionally during include setup. Execution occurs before child workflow parsing and before any language model is invoked.

The same sink is reachable through the higher-level praisonai.recipe.run() API. This makes the vulnerability a variant of the previously disclosed automatic tools.py remote code execution family, defeating the hardening applied in earlier fixes.

Root Cause

The root cause is missing enforcement of the safe-loader contract in Workflow._execute_include(). The include path was added without wiring it into the central loader that checks PRAISONAI_ALLOW_TEMPLATE_TOOLS and PRAISONAI_ALLOW_LOCAL_TOOLS before executing arbitrary local Python. Trust is implicitly granted to any local recipe directory referenced by an include statement.

Attack Vector

Exploitation requires an attacker to influence the local recipe directory that a victim process includes. This typically occurs through supply chain compromise, a malicious recipe distributed to a developer, or a shared workspace where recipe files can be modified. When the victim runs the workflow or calls praisonai.recipe.run() against the tainted recipe, PraisonAI silently imports the attacker-supplied tools.py, running its module-level statements as the PraisonAI process user.

No verified exploitation code is public. See the GitHub Security Advisory GHSA-hxmv-c4g6-5fqc for the maintainer analysis.

Detection Methods for CVE-2026-55522

Indicators of Compromise

Unexpected tools.py files present in recipe directories referenced by workflow include statements.
Child processes, outbound network connections, or file writes initiated by the PraisonAI process immediately after workflow load and before any model API call.
Recipe directories sourced from untrusted repositories, shared drives, or newly cloned locations.

Detection Strategies

Audit workflow YAML and Python recipe files for include references that resolve to writable or externally sourced directories.
Instrument the Python runtime to log calls to importlib.util.spec_from_file_location() and spec.loader.exec_module() originating from PraisonAI modules.
Compare installed praisonai and praisonaiagents package versions against the fixed releases across developer workstations and CI runners.

Monitoring Recommendations

Alert on process creation, shell execution, or credential file access by the Python interpreter running PraisonAI workloads.
Monitor for modifications to tools.py files inside recipe directories tracked by source control.
Correlate PraisonAI process activity with egress traffic to unexpected destinations during workflow initialization.

How to Mitigate CVE-2026-55522

Immediate Actions Required

Upgrade praisonai to version 4.6.58 or later and praisonaiagents to version 1.6.58 or later.
Inventory all workflows and recipes that use the include feature and verify the source of every referenced directory.
Restrict write permissions on recipe directories to trusted users and pipelines only.

Patch Information

The maintainers fixed the flaw in praisonai 4.6.58 and praisonaiagents 1.6.58. The fix routes Workflow._execute_include() through the centralized safe loader and honors the PRAISONAI_ALLOW_TEMPLATE_TOOLS and PRAISONAI_ALLOW_LOCAL_TOOLS opt-in gates. Refer to the GitHub Security Advisory GHSA-hxmv-c4g6-5fqc for release notes.

Workarounds

Do not run PraisonAI workflows or call praisonai.recipe.run() against recipe directories that are not fully controlled by your organization.
Run PraisonAI under a dedicated low-privilege user account with no access to secrets, cloud credentials, or production data.
Execute untrusted workflows inside an isolated container or sandbox with restricted network egress and read-only application code.

bash

# Upgrade to the patched releases
pip install --upgrade 'praisonai>=4.6.58' 'praisonaiagents>=1.6.58'

# Verify installed versions
pip show praisonai praisonaiagents | grep -E '^(Name|Version)'