CVE-2026-61437: PraisonAI: unsafe dynamic import enables RCE

PraisonAI's workflow engine imports a sibling tools.py file via unsandboxed importlib exec_module whenever a workflow step references a string output_pydantic class, and it does this even when the PRAISONAI_ALLOW_*_TOOLS safety flags are set to block it. A CVSS 7.8 rating (AV:L/PR:N/UI:R, full confidentiality/integrity/availability impact) means anyone who gets a victim to load a crafted workflow file plus its matching tools.py — via a shared template, a compromised repo, or an internal collaboration channel — achieves arbitrary Python code execution with the privileges of the workflow runner. There is no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so this is not an actively exploited, mass-scan threat today; the risk is concentrated wherever teams run PraisonAI workflows sourced from outside their direct control. Patch to praisonaiagents 1.6.78 or later immediately, and until then treat any workflow YAML/tools.py pair from a non-trusted source as untrusted code — do not load or execute it via WorkflowManager or load_yaml. Security teams should also stop relying on PRAISONAI_ALLOW_*_TOOLS as a control, since this vulnerability bypasses it entirely, and should audit recently imported third-party workflow templates for suspicious tools.py files.

Proof-of-concept exploit code is publicly available for CVE-2026-61437, increasing the risk of exploitation.

1) Upgrade praisonaiagents to version 1.6.78 or later immediately. 2) Until patched, do not load or execute PraisonAI workflow files (and their sibling tools.py) from any source you don't fully control or haven't code-reviewed — this includes shared templates, community repos, and internal wikis. 3) Do not rely on PRAISONAI_ALLOW_*_TOOLS environment variables as a security boundary for this issue, since the vulnerable path ignores them. 4) Run PraisonAI workflow execution in a sandboxed, least-privilege environment (container with no access to sensitive credentials/network) to limit blast radius if exploitation occurs. 5) Detection: monitor for unexpected child processes or outbound network connections spawned by the PraisonAI runtime process, and audit for recently added or modified tools.py files alongside workflow YAML/JSON definitions in your repos.

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent workflow orchestration, AI agent tool invocation pipelines.

CVE-2026-61437 has a CVSS v3.1 base score of 7.8 (HIGH). The EPSS exploitation probability is 0.17%.