CVE-2026-61437: PraisonAI RCE Vulnerability

CVE-2026-61437 Overview

CVE-2026-61437 is an unsafe dynamic module loading vulnerability in PraisonAI, distributed as the praisonaiagents pip package. Versions before 1.6.78 are affected. The flaw resides in AgentFlow._resolve_pydantic_class within src/praisonai-agents/praisonaiagents/workflows/workflows.py. When a workflow step references a Pydantic class by string, the framework imports a sibling tools.py from the workflow file's directory using importlibexec_module without sandboxing. The loader ignores the PRAISONAI_ALLOW_*_TOOLS environment variables intended to gate tool loading. An attacker who controls the workflow file and its adjacent tools.py can execute arbitrary Python code with the workflow runner's privileges.

Critical Impact
Arbitrary Python code execution occurs when a crafted workflow file is loaded through WorkflowManager or after load_yaml, running with the privileges of the process invoking PraisonAI.

Affected Products

PraisonAI praisonaiagents pip package versions before 1.6.78
Applications embedding PraisonAI's WorkflowManager for agent orchestration
Pipelines that ingest third-party or user-supplied workflow YAML files

Discovery Timeline

2026-07-10 - CVE-2026-61437 published to the National Vulnerability Database (NVD)
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-61437

Vulnerability Analysis

PraisonAI is an agent orchestration framework that executes multi-step workflows defined in YAML. Each workflow step can declare an output_pydantic reference as a string, instructing the framework to resolve that name to a Python class at runtime. The resolver in AgentFlow._resolve_pydantic_class locates a tools.py file in the same directory as the workflow definition and loads it through importlib.util.spec_from_file_location combined with exec_module. Executing a module in Python runs its top-level statements, so any code placed in tools.py runs when the workflow is parsed. The classification [CWE-693] (Protection Mechanism Failure) applies because the framework exposes PRAISONAI_ALLOW_*_TOOLS environment gates that are supposed to restrict tool loading, yet this code path bypasses them entirely.

Root Cause

The resolver assumes the workflow directory is trusted and treats string references to Pydantic classes as a signal to import sibling modules. No allowlist, signature check, or sandbox is applied. The environment-based enforcement that gates other tool loading paths is not consulted, breaking the framework's own protection model.

Attack Vector

Exploitation requires the attacker to control both a workflow YAML file and its co-located tools.py. When a user or automated pipeline runs WorkflowManager against the workflow, or calls load_yaml, the malicious tools.py is imported and its module-level code executes. Delivery paths include supply-chain compromise of workflow repositories, shared workflow directories, cloned template projects, and any automation that fetches workflow bundles from external sources. Because attack complexity is low and no authentication is required beyond loading the workflow, user interaction to run the workflow is the primary trigger.

No public proof-of-concept code has been released. Refer to the GitHub Security Advisory and the VulnCheck Advisory for the technical write-up.

Detection Methods for CVE-2026-61437

Indicators of Compromise

Presence of tools.py files adjacent to workflow YAML files that were not authored by the local team
Unexpected child processes spawned by the Python interpreter running praisonaiagents, such as shells, curl, wget, or package managers
Outbound network connections from the workflow runner host shortly after WorkflowManager or load_yaml execution
New cron entries, systemd units, or SSH authorized_keys modifications made by the workflow runner service account

Detection Strategies

Inventory installed praisonaiagents versions across developer laptops, CI runners, and production hosts and flag any release below 1.6.78
Alert on file system events that create or modify tools.py in directories containing PraisonAI workflow YAML
Monitor for importlib loading files from writable, user-controlled directories under Python processes running PraisonAI

Monitoring Recommendations

Enable process lineage logging on hosts that execute PraisonAI so downstream commands from the Python runtime are captured
Ship workflow directory audit logs to a centralized data lake and correlate with praisonaiagents process activity
Baseline expected outbound destinations from workflow runner hosts and alert on deviations

How to Mitigate CVE-2026-61437

Immediate Actions Required

Upgrade praisonaiagents to version 1.6.78 or later using pip install --upgrade praisonaiagents
Audit all workflow directories for unauthorized or unexpected tools.py files and remove or quarantine them
Restrict write permissions on workflow directories so only trusted maintainers can add or modify Python files
Rotate credentials and API keys accessible to any workflow runner that processed untrusted workflows before patching

Patch Information

The vendor fixed the vulnerability in PraisonAI praisonaiagents1.6.78. Details of the code changes are documented in the GitHub Security Advisory GHSA-4gfv-wg42-7jw5. Rebuild any container images or virtual environments that pin an older version and confirm downstream dependency locks are updated.

Workarounds

Only load workflow YAML files from directories owned by trusted maintainers and stored on read-only mounts where feasible
Run WorkflowManager under a low-privilege service account with no access to production secrets or sensitive file systems
Isolate workflow execution inside a container or sandbox with restricted network egress and no persistent volume writes
Treat workflow bundles from third parties as untrusted input and review the accompanying tools.py before execution

bash

# Upgrade to the patched release
pip install --upgrade 'praisonaiagents>=1.6.78'

# Verify the installed version
python -c "import praisonaiagents, importlib.metadata as m; print(m.version('praisonaiagents'))"

# Locate sibling tools.py files next to workflow YAML for review
find /path/to/workflows -type f -name 'tools.py' -printf '%p\n'