Vulnerability · Published Jul 10, 2026 · Assigned by VulnCheck

CVE-2026-61437PraisonAI before 1.6.78 Remote Code Execution via tools.py

High 7.8

In plain English

A high-severity security flaw in PraisonAI from MervinPraison. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.2%top 90.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

PraisonAI (pip package praisonaiagents) before 1.6.78 contains an unsafe dynamic module loading vulnerability in AgentFlow._resolve_pydantic_class (src/praisonai-agents/praisonaiagents/workflows/workflows.py). When a workflow step uses a string output_pydantic reference, the framework locates and imports a sibling tools.py from the workflow file's directory via importlib exec_module without sandboxing, ignoring the PRAISONAI_ALLOW_*_TOOLS environment variables. An attacker who controls a workflow file and its sibling tools.py can execute arbitrary Python code with the workflow runner's privileges when the workflow is executed via WorkflowManager or after load_yaml.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	praisonaiagents	1.6.78	GHSA-4gfv-wg42-7jw5
PyPI	praisonaiagents	1.6.78	PYSEC-2026-4267

Affected products (as reported)

Vendor	Product	Versions
MervinPraison	PraisonAI	0 – before 1.6.78

Weakness: CWE-693 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-4gfv-wg42-7jw5) vendor-advisory
VulnCheck Advisory: PraisonAI before 1.6.78 Remote Code Execution via tools.py third-party-advisory