CVE-2026-55522: PraisonAI RCE — HIGH

CISO Take

PraisonAI's workflow 'include' feature loads a companion recipe's tools.py via a raw importlib import and executes it immediately as module-level code, and this path skips both the PRAISONAI_ALLOW_TEMPLATE_TOOLS/PRAISONAI_ALLOW_LOCAL_TOOLS opt-in gates and the centralized safe loader that PraisonAI otherwise relies on to vet autoloaded tools. For teams running multi-agent PraisonAI workflows that consume shared or externally-sourced recipe templates — internal marketplaces, community recipe repos, CI pipelines pulling workflow definitions — this is a full code-execution path that fires before any model call or workflow validation, so prompt-level guardrails and model safety filters offer zero protection. It's rated high severity (CVSS 7.8, C:H/I:H/A:H) but requires local access and user interaction, and EPSS sits at just 0.15% with no public PoC, no Nuclei template, and no CISA KEV listing — this is attend-and-patch, not drop-everything. Notably, this is an explicit bypass of a previously-fixed automatic tools.py RCE advisory in the same package family, signaling the vendor's autoload hardening has recurring gaps worth re-auditing; upgrade to praisonai >=4.6.58 / praisonaiagents >=1.6.58 immediately, and until then treat any workflow include or recipe.run() call against non-first-party recipe directories as untrusted code execution.

Sources: NVD EPSS GitHub Advisory ATLAS

What is the risk?

High-impact (full C/I/A compromise of the process) but constrained exploitation path: local attack vector, low complexity, no privileges required, but requires user interaction (the victim or an automated pipeline must run a workflow/recipe pointing at attacker-controlled content). EPSS (0.15%, ~top-95th percentile of low-likelihood CVEs) and absence of KEV listing, public exploit, or scanner template indicate exploitation is currently theoretical rather than observed in the wild. Real-world risk concentrates in teams that consume shared/community/third-party PraisonAI recipes or automate workflow execution from external sources (CI, marketplaces, collaborative repos) — for those, the bar to exploitation is low since the sink triggers before any LLM call or safety check.

How does the attack unfold?

Malicious recipe staging

Attacker crafts a local recipe directory containing a malicious tools.py and gets it referenced by the victim (shared template, public repo, phishing) as part of a PraisonAI workflow.

AML.T0011

Include-triggered execution

Victim's workflow uses the 'include' feature or calls praisonai.recipe.run(); Workflow._execute_include() imports and executes tools.py via importlib without honoring autoload gates or the safe loader.

AML.T0050

Arbitrary code execution

Attacker-controlled Python code runs at module level as the PraisonAI process user, before any child workflow parsing or model call occurs.

AML.T0112.000

Post-exploitation impact

Attacker leverages process-level access to exfiltrate secrets, pivot to connected tools/services, or persist on the host.

AML.T0112.000

Malicious recipe staging

Attacker crafts a local recipe directory containing a malicious tools.py and gets it referenced by the victim (shared template, public repo, phishing) as part of a PraisonAI workflow.

AML.T0011

Include-triggered execution

Victim's workflow uses the 'include' feature or calls praisonai.recipe.run(); Workflow._execute_include() imports and executes tools.py via importlib without honoring autoload gates or the safe loader.

AML.T0050

Arbitrary code execution

Attacker-controlled Python code runs at module level as the PraisonAI process user, before any child workflow parsing or model call occurs.

AML.T0112.000

Post-exploitation impact

Attacker leverages process-level access to exfiltrate secrets, pivot to connected tools/services, or persist on the host.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	>= 3.9.26, < 4.6.58	`4.6.58`
1 dependents 65% patched ~13d to patch Full package profile →
PraisonAI	pip	—	No patch
1 dependents 65% patched ~13d to patch Full package profile →
PraisonAI Agents	pip	>= 0.12.12, < 1.6.58	`1.6.58`
20 dependents 59% patched ~6d to patch Full package profile →

How severe is it?

CVSS 3.1

7.8 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 5% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Local

AC Low

PR None

UI Required

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Upgrade immediately to praisonai >=4.6.58 and praisonaiagents >=1.6.58. 2) Until patched, treat workflow 'include' and recipe.run() calls as command execution: only reference recipe directories from fully trusted, version-controlled, internally-reviewed sources — never third-party or community templates. 3) Run PraisonAI processes with least privilege (non-root, containerized, restricted filesystem/network egress) to cap blast radius if exploited. 4) Audit CI/automation pipelines for any step that pulls and executes external workflow/recipe definitions. 5) Detection: monitor PraisonAI process trees for unexpected child processes or unusual module loads at workflow-include time; file integrity monitoring on recipe/tools.py directories. 6) Re-verify PRAISONAI_ALLOW_TEMPLATE_TOOLS/PRAISONAI_ALLOW_LOCAL_TOOLS enforcement is consistent post-patch, since this CVE shows the gate was previously bypassable via a parallel code path.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Supply Chain Agent Plugin Framework AML.T0011 - User Execution AML.T0011.002 - Poisoned AI Agent Tool AML.T0050 - Command and Scripting Interpreter AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.3 - Third-party and supplier AI system relationships

NIST AI RMF

GOVERN-6.1 - Third-party AI system component risk

OWASP LLM Top 10

LLM03:2025 - Supply Chain Vulnerabilities LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-55522?

PraisonAI's workflow 'include' feature loads a companion recipe's tools.py via a raw importlib import and executes it immediately as module-level code, and this path skips both the PRAISONAI_ALLOW_TEMPLATE_TOOLS/PRAISONAI_ALLOW_LOCAL_TOOLS opt-in gates and the centralized safe loader that PraisonAI otherwise relies on to vet autoloaded tools. For teams running multi-agent PraisonAI workflows that consume shared or externally-sourced recipe templates — internal marketplaces, community recipe repos, CI pipelines pulling workflow definitions — this is a full code-execution path that fires before any model call or workflow validation, so prompt-level guardrails and model safety filters offer zero protection. It's rated high severity (CVSS 7.8, C:H/I:H/A:H) but requires local access and user interaction, and EPSS sits at just 0.15% with no public PoC, no Nuclei template, and no CISA KEV listing — this is attend-and-patch, not drop-everything. Notably, this is an explicit bypass of a previously-fixed automatic tools.py RCE advisory in the same package family, signaling the vendor's autoload hardening has recurring gaps worth re-auditing; upgrade to praisonai >=4.6.58 / praisonaiagents >=1.6.58 immediately, and until then treat any workflow include or recipe.run() call against non-first-party recipe directories as untrusted code execution.

Is CVE-2026-55522 actively exploited?

No confirmed active exploitation of CVE-2026-55522 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-55522?

1) Upgrade immediately to praisonai >=4.6.58 and praisonaiagents >=1.6.58. 2) Until patched, treat workflow 'include' and recipe.run() calls as command execution: only reference recipe directories from fully trusted, version-controlled, internally-reviewed sources — never third-party or community templates. 3) Run PraisonAI processes with least privilege (non-root, containerized, restricted filesystem/network egress) to cap blast radius if exploited. 4) Audit CI/automation pipelines for any step that pulls and executes external workflow/recipe definitions. 5) Detection: monitor PraisonAI process trees for unexpected child processes or unusual module loads at workflow-include time; file integrity monitoring on recipe/tools.py directories. 6) Re-verify PRAISONAI_ALLOW_TEMPLATE_TOOLS/PRAISONAI_ALLOW_LOCAL_TOOLS enforcement is consistent post-patch, since this CVE shows the gate was previously bypassable via a parallel code path.

What systems are affected by CVE-2026-55522?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent orchestration pipelines, workflow/recipe automation, CI/CD pipelines running AI workflows.

What is the CVSS score for CVE-2026-55522?

CVE-2026-55522 has a CVSS v3.1 base score of 7.8 (HIGH). The EPSS exploitation probability is 0.15%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent orchestration pipelinesworkflow/recipe automationCI/CD pipelines running AI workflows

MITRE ATLAS Techniques

AML.T0011 User Execution

AML.T0011.002 Poisoned AI Agent Tool

AML.T0050 Command and Scripting Interpreter

AML.T0112.000 Local AI Agent

Compliance Controls Affected

ISO 42001: A.6.2.3

NIST AI RMF: GOVERN-6.1

OWASP LLM Top 10: LLM03:2025, LLM06:2025

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. In versions 3.9.26 through 4.6.57 of praiseonai and 0.12.12 through 1.6.57 of praiseonaiagents, the workflow "include" feature is vulnerable to code execution. Workflow._execute_include() implicitly imports and runs an included recipe's tools.py via a raw importlib.util.spec_from_file_location() and spec.loader.exec_module() call, without honoring the PRAISONAI_ALLOW_TEMPLATE_TOOLS/PRAISONAI_ALLOW_LOCAL_TOOLS autoload opt-in gates or routing through the centralized safe loader that protects the other tools.py autoload paths. As a result, a workflow that includes an attacker-controlled local recipe directory executes arbitrary module-level Python code during include setup, before any child workflow parsing or model call, and the same sink is reachable through the higher-level praisonai.recipe.run() recipe API. An attacker who can cause a victim process to run a workflow or recipe that includes an untrusted local recipe achieves arbitrary Python code execution as the PraisonAI process user, a variant that bypasses the hardening applied to the previously disclosed automatic tools.py RCE advisory family. This issue has been fixed in version 4.6.58 of praisonai and 1.6.58 of praisonaiagents.

Exploitation Scenario

An attacker publishes a seemingly useful PraisonAI recipe template to a public repository or community marketplace, or sends it directly to a target AI/ML engineer via social engineering. The victim's application (or an automated pipeline) executes a workflow that includes this recipe, or calls praisonai.recipe.run() pointing at the attacker's directory. Workflow._execute_include() unconditionally imports and executes the recipe's tools.py via importlib, running the attacker's arbitrary Python code as the PraisonAI process user — before any workflow validation or model call occurs. From there the attacker can exfiltrate environment secrets/API keys, pivot to other connected tools/services, or establish persistence on the host.

Weaknesses (CWE)

CWE-426 Untrusted Search Path Primary CWE-426 Untrusted Search Path Primary CWE-829 Inclusion of Functionality from Untrusted Control Sphere Primary CWE-829 Inclusion of Functionality from Untrusted Control Sphere Primary CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-426 Untrusted Search Path CWE-829 Inclusion of Functionality from Untrusted Control Sphere CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE-426 — Untrusted Search Path: The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

[Architecture and Design, Implementation] Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
[Implementation] When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.

Source: MITRE CWE corpus.