CVE-2026-61437: PraisonAI Unsafe Dynamic Module Loading Remote Code Execution

Technical summary

The vulnerability exists in AgentFlow._resolve_pydantic_class() within the workflows module. When a workflow step specifies a Pydantic model output via a string reference, the code dynamically imports a tools.py module from the workflow file's directory using importlib.exec_module(). This dynamic loading bypasses the security-relevant PRAISONAI_ALLOW_*_TOOLS environment variables that are designed to control what tools can be loaded. The lack of sandboxing means any Python code in the imported tools.py executes unconditionally. An attacker gaining write access to workflow configuration files and their sibling directory can weaponize this to achieve arbitrary code execution—the severity is amplified because it affects any application or pipeline that processes untrusted or attacker-controlled workflow definitions.

Business impact

Organizations using PraisonAI in production automation, multi-tenant SaaS platforms, or shared development environments face direct code execution risk. If an attacker compromises a workflow file (via supply chain, insider threat, or misconfigured repository access), they gain the same privileges as the WorkflowManager process—potentially accessing secrets, modifying data, or establishing persistence. DevOps pipelines that auto-load workflows are particularly exposed. The primary risk scenario is environments where workflow files come from less-trusted sources or where directory permissions are not tightly controlled.

Affected systems

PraisonAI versions before 1.6.78 are vulnerable. This affects any Python application that installs the praisonaiagents pip package and invokes WorkflowManager.run() or load_yaml() on workflow files. Exposure is highest in: (1) AI/ML automation platforms using PraisonAI as an orchestration layer, (2) CI/CD or MLOps pipelines that dynamically load workflows, (3) multi-user or multi-tenant environments where workflow files may be user-supplied, and (4) containerized deployments where the workflow runner identity has broad system access.

Exploitability

Exploitability requires local file system write access to both a workflow configuration file and its sibling tools.py directory. This is not remotely exploitable over the network in isolation, but is highly exploitable if: an attacker can commit to a repository containing workflows, gains access to a shared filesystem, or can manipulate files uploaded to a system before processing. The UI/user interaction requirement in the CVSS vector reflects that a user or process must explicitly execute the workflow. Once those preconditions are met, exploitation is trivial—any valid Python code in tools.py will execute automatically without additional user interaction or detection evasion.

Remediation

Upgrade PraisonAI to version 1.6.78 or later immediately. The patch hardens the dynamic module loading by enforcing the PRAISONAI_ALLOW_*_TOOLS environment variable checks and restricting unpredictable tool imports. Additionally, implement preventive controls: (1) restrict write permissions on workflow file directories to trusted accounts only, (2) use code review for any workflow configuration changes, (3) run workflow processes with minimal necessary privileges (principle of least privilege), and (4) consider using signed or attested workflow files if deploying from shared sources.

Patch guidance

Verify the installed version using 'pip show praisonaiagents' or your dependency management tool. Update using 'pip install --upgrade praisonaiagents' to pull version 1.6.78 or later from PyPI. For pinned dependencies in requirements.txt or poetry.lock, update the constraint and re-lock. Test workflows in a staging environment after patching to confirm compatibility. If you have older deployments, prioritize patching based on whether they process untrusted or user-supplied workflow definitions.

Detection guidance

Monitor for suspicious imports or code execution originating from tools.py files co-located with workflow configurations. Log and alert on: (1) importlib.exec_module() calls within the PraisonAI codebase or workflow execution, (2) unexpected process spawn or network activity initiated from workflow runners, (3) modifications to tools.py files in production or CI/CD workflow directories. Forensically, check Git history, file modification timestamps, and process execution logs around the time workflows were loaded to identify unauthorized changes.

Why prioritize this

This vulnerability merits urgent patching despite the local-access requirement because: (1) it enables unauthenticated arbitrary code execution once file-system access is obtained, (2) it affects a growing ecosystem of AI/ML automation tools where workflow files are frequently automated or user-supplied, (3) the security controls (PRAISONAI_ALLOW_*_TOOLS) that should prevent this are completely bypassed, and (4) the blast radius in CI/CD or shared infrastructure contexts is very high. HIGH severity (7.8 CVSS) is appropriate. Organizations should patch within 1–2 weeks depending on exposure profile.

Risk score, explained

CVSS 7.8 (HIGH) reflects: confidentiality, integrity, and availability all high impact (the attacker gains full code execution), local attack vector (requires file-system write access), no privilege escalation required (runs as the workflow process user), and no network isolation (attack succeeds in standard deployment). The score would be CRITICAL if the vector were AV:N, but local-only access prevents that. However, in cloud-native and CI/CD environments where workflows are pervasively orchestrated, the practical risk may exceed the CVSS score.

Frequently asked questions