CVE-2026-62165

Name of the Vulnerable Software and Affected Versions PraisonAI (affected versions not specified)

Description The plugin manager loads and executes arbitrary .py files from the .praisonai/plugins/ directories located at both the project level and the user home. This occurs through the use of importlib.util.spec from file location() and exec module() without any code signing, integrity verification, or sandboxing. An attacker capable of writing a file to these directories—via path traversal, supply chain attacks, or compromised dependencies—can achieve arbitrary code execution during the plugin system initialization. The process involves the load plugin file() function in src/praisonai-agents/praisonaiagents/plugins/manager.py, which executes the module and may call the create plugin() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.