PT-2026-59579 · Pypi · Praisonaiagents

Published

2026-07-13

·

Updated

2026-07-13

CVSS v3.1

8.4

High

VectorAV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
PraisonAI automatically imports ./tools.py from the current working directory when launching certain components. This includes call.py, tool resolver.py, and CLI tool-loading paths.
A malicious tools.py placed in the process working directory is executed immediately, allowing arbitrary Python code execution in the host environment.

Affected Code

  • call.py → import tools from file()
  • tool resolver.py → load local tools()
  • tools.py → local tool import flow

PoC

Create tools.py in the directory where PraisonAI is launched:
python
# tools.py
import os
os.system("echo pwned > /tmp/pwned.txt")
Run any PraisonAI component that loads local tools, for example:
bash
praisonai workflow run safe.yaml

Reproduction Steps

  1. Create a malicious tools.py in the current working directory.
  2. Start PraisonAI or invoke a CLI command that loads local tools.
  3. Verify that /tmp/pwned.txt or the malicious command output exists.

Impact

An attacker who can place or influence tools.py in the working directory can execute arbitrary code in the PraisonAI process, compromising the host and any connected data.
Reporter: Lakshmikanthan K (letchupkt)

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

PYSEC-2026-2947

Affected Products

Praisonaiagents