CVE-2026-47398: PraisonAI RCE via ungated exec_module

CISO Take

PraisonAI versions up to 4.6.37 contain two unguarded `spec.loader.exec_module` call sites in `agents_generator.py` that execute arbitrary Python files referenced from YAML agent configurations, bypassing the env-var gate applied in three prior patch rounds (CVE-2026-40156, CVE-2026-40287, CVE-2026-44334). With the recipe server's default no-auth posture and `allow_any_github=True`, an unauthenticated attacker can achieve remote code execution via a single HTTP POST request — a public PoC bash script is included in the advisory, placing weaponization within reach of unsophisticated actors. The 59 other CVEs in this package and a systemic pattern of incomplete patch series signal structural security debt that should raise red flags for any team running PraisonAI in production or CI/CD. Upgrade to praisonai >= 4.6.40 immediately; if patching is blocked, restrict or disable the `/v1/recipes/run` endpoint and ensure `allow_any_github` is set to false.

Sources: GitHub Advisory NVD ATLAS

What is the risk?

Critical risk in network-facing deployments. The structured CVE data scores this 8.1 High (AV:N/AC:H); the advisory escalates to 9.8 Critical when the recipe server runs with default no-auth settings and allow_any_github=True — both common in out-of-the-box deployments. This is the fourth bypass in a series of incomplete patches targeting the same exec_module sink family, meaning the maintainers' track record of fully closing the attack surface is poor and future patches warrant scrutiny. With a trivial public PoC and no authentication requirement in the network vector, exploitation probability is high regardless of low current EPSS data (CVE is newly published). AI agent frameworks running in CI/CD pipelines, shared development environments, or multi-tenant SaaS platforms face the broadest blast radius.

How does the attack unfold?

Initial Access

Attacker publishes a malicious public GitHub repository containing agents.yaml with module_path pointing to a colocated evil.py payload, leveraging the recipe fetch capability.

AML.T0049

Configuration Injection

Attacker sends an unauthenticated POST to /v1/recipes/run referencing the malicious GitHub recipe; PraisonAI fetches and parses the attacker-controlled agents.yaml without validation.

AML.T0081

Code Execution

AgentsGenerator.load_tools_from_module() calls spec.loader.exec_module() on evil.py with no PRAISONAI_ALLOW_LOCAL_TOOLS gate check, executing the payload as the service account before any LLM interaction.

AML.T0050

Impact

Attacker achieves full host compromise — exfiltrating AI API keys and credentials, establishing persistence, or pivoting to connected databases and vector stores — entirely within the tool-loading phase.

AML.T0048

Initial Access

Attacker publishes a malicious public GitHub repository containing agents.yaml with module_path pointing to a colocated evil.py payload, leveraging the recipe fetch capability.

AML.T0049

Configuration Injection

Attacker sends an unauthenticated POST to /v1/recipes/run referencing the malicious GitHub recipe; PraisonAI fetches and parses the attacker-controlled agents.yaml without validation.

AML.T0081

Code Execution

AgentsGenerator.load_tools_from_module() calls spec.loader.exec_module() on evil.py with no PRAISONAI_ALLOW_LOCAL_TOOLS gate check, executing the payload as the service account before any LLM interaction.

AML.T0050

Impact

Attacker achieves full host compromise — exfiltrating AI API keys and credentials, establishing persistence, or pivoting to connected databases and vector stores — entirely within the tool-loading phase.

AML.T0048

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	<= 4.6.39	`4.6.40`
1 dependents 68% patched ~14d to patch Full package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 26% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC High

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

6 steps

Upgrade to praisonai >= 4.6.40 — the only confirmed remediation.
If upgrade is blocked: set PRAISONAI_ALLOW_LOCAL_TOOLS to any value other than 'true' (note: agents_generator.py does NOT check this gate, so it only helps other sinks — treat as defense-in-depth, not a fix).
Disable or place behind strong authentication the /v1/recipes/run endpoint; explicitly set allow_any_github=False in recipe server config.
Audit all agents.yaml files in use for unexpected module_path entries referencing .py files, especially relative paths.
Detection: alert on Python process execution spawning from /tmp or unexpected working directories; watch for file writes matching praisonai_*_pwn_*.txt in /tmp as PoC fingerprint.
In CI/CD contexts, pin the praisonai version and validate YAML agent configs against a strict schema — reject any config containing module_path keys that reference filesystem paths.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Supply Chain Agent Framework AML.T0002.002 - AI Agent Configuration AML.T0010.005 - AI Agent Tool AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity Article 9 - Risk management system

ISO 42001

6.1.2 - AI risk assessment 8.4 - AI system lifecycle

NIST AI RMF

MANAGE 2.2 - AI risk treatment

OWASP LLM Top 10

LLM03:2025 - Supply Chain Vulnerabilities LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-47398?

PraisonAI versions up to 4.6.37 contain two unguarded `spec.loader.exec_module` call sites in `agents_generator.py` that execute arbitrary Python files referenced from YAML agent configurations, bypassing the env-var gate applied in three prior patch rounds (CVE-2026-40156, CVE-2026-40287, CVE-2026-44334). With the recipe server's default no-auth posture and `allow_any_github=True`, an unauthenticated attacker can achieve remote code execution via a single HTTP POST request — a public PoC bash script is included in the advisory, placing weaponization within reach of unsophisticated actors. The 59 other CVEs in this package and a systemic pattern of incomplete patch series signal structural security debt that should raise red flags for any team running PraisonAI in production or CI/CD. Upgrade to praisonai >= 4.6.40 immediately; if patching is blocked, restrict or disable the `/v1/recipes/run` endpoint and ensure `allow_any_github` is set to false.

Is CVE-2026-47398 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-47398, increasing the risk of exploitation.

How to fix CVE-2026-47398?

1. Upgrade to praisonai >= 4.6.40 — the only confirmed remediation. 2. If upgrade is blocked: set PRAISONAI_ALLOW_LOCAL_TOOLS to any value other than 'true' (note: agents_generator.py does NOT check this gate, so it only helps other sinks — treat as defense-in-depth, not a fix). 3. Disable or place behind strong authentication the /v1/recipes/run endpoint; explicitly set allow_any_github=False in recipe server config. 4. Audit all agents.yaml files in use for unexpected module_path entries referencing .py files, especially relative paths. 5. Detection: alert on Python process execution spawning from /tmp or unexpected working directories; watch for file writes matching praisonai_*_pwn_*.txt in /tmp as PoC fingerprint. 6. In CI/CD contexts, pin the praisonai version and validate YAML agent configs against a strict schema — reject any config containing module_path keys that reference filesystem paths.

What systems are affected by CVE-2026-47398?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, CI/CD AI pipelines, Multi-tenant agent platforms, Recipe and automation servers.

What is the CVSS score for CVE-2026-47398?

CVE-2026-47398 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.33%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksCI/CD AI pipelinesMulti-tenant agent platformsRecipe and automation servers

MITRE ATLAS Techniques

AML.T0002.002 AI Agent Configuration

AML.T0010.005 AI Agent Tool

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15, Article 9

ISO 42001: 6.1.2, 8.4

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM03:2025, LLM06:2025

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. The v4.6.32 chokepoint refactor (which patched CVE-2026-44334 / GHSA-xcmw-grxf-wjhj) added the PRAISONAI_ALLOW_LOCAL_TOOLS env-var gate to the tool_override.py sinks. However, two additional spec.loader.exec_module call sites in praisonai/agents_generator.py were missed and remain completely unguarded in versions prior to 4.6.40. Both functions accept a module_path parameter sourced from YAML configuration and execute it without validation, signature checking, or the env-var gate. Version 4.6.40 fixes the issue.

Exploitation Scenario

An attacker creates a public GitHub repository containing two files: evil.py (which exfiltrates environment variables including AI API keys and writes a persistence mechanism) and agents.yaml declaring a poc_agent with tools referencing module_path: ./evil.py. They send an unauthenticated HTTP POST to the target's recipe server at POST /v1/recipes/run with body {"recipe": "github:attacker/repo/recipe"}. PraisonAI fetches the recipe, parses agents.yaml, and calls AgentsGenerator.load_tools_from_module('./evil.py'). Since agents_generator.py line 351 calls spec.loader.exec_module(module) with no PRAISONAI_ALLOW_LOCAL_TOOLS check, evil.py executes immediately with the privileges of the PraisonAI process — before any LLM interaction, before any API authentication, before any output filtering. The attacker harvests credentials, pivots to connected databases or vector stores, and plants a backdoor — all in the tool-loading phase that the application treats as infrastructure setup.

Weaknesses (CWE)

CWE-829 Inclusion of Functionality from Untrusted Control Sphere Primary CWE-829 Inclusion of Functionality from Untrusted Control Sphere Primary CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-829 Inclusion of Functionality from Untrusted Control Sphere CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE-829 — Inclusion of Functionality from Untrusted Control Sphere: The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
[Architecture and Design] When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap [REF-45] provide this capability.

Source: MITRE CWE corpus.