CVE-2026-47391

Name of the Vulnerable Software and Affected Versions PraisonAI (affected versions not specified)

Description The first-party A2A server example in PraisonAI contains a critical chain that allows remote code execution. The example binds the server to 0.0.0.0 and exposes the /a2a endpoint without requiring an auth token. Additionally, it registers a calculate(expression) tool that uses the Python eval() function to process input. An unauthenticated remote attacker can send a JSON-RPC message/send request to the /a2a endpoint, which is passed to agent.chat(). A Large Language Model (LLM) can then be induced to invoke the calculate() function, leading to arbitrary Python code execution within the server process. This can result in full compromise of server process privileges, unauthorized file access, and exposure of environment variables. Furthermore, unauthenticated access to the A2A surface exposes task state APIs such as tasks/list, tasks/get, and tasks/cancel, compromising data confidentiality and integrity.

Recommendations Remove the eval() function from the official A2A example and replace it with a safe expression parser. Change the default server binding from 0.0.0.0 to 127.0.0.1. Configure a mandatory auth token for the /a2a endpoint to prevent unauthenticated access. Restrict the use of the calculate() function or any tool utilizing eval() until a secure implementation is provided.