CVE-2026-61437: PraisonAI before 1.6.78 Remote Code Execution via tools.py
PraisonAI (pip package praisonaiagents) before 1.6.78 contains an unsafe dynamic module loading vulnerability in AgentFlow.resolvepydanticclass (src/praisonai-agents/praisonaiagents/workflows/workflows.py). When a workflow step uses a string outputpydantic reference, the framework locates and imports a sibling tools.py from the workflow file's directory via importlib execmodule without sandboxing, ignoring the PRAISONAIALLOWTOOLS environment variables. An attacker who controls a workflow file and its sibling tools.py can execute arbitrary Python code with the workflow runner's privileges when the workflow is executed via WorkflowManager or after loadyaml.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
praisonaiagents (pip package praisonaiagents)to a version that resolves this vulnerability.Fixed in 1.6.78 - Configuration
Do not rely on PRAISONAI_ALLOW_*_TOOLS to prevent sibling tools.py execution; upgrading to >= 1.6.78 is required because the vulnerable behavior ignores these environment variables when importing tools.py via importlib exec_module.
PraisonAI AgentFlow PRAISONAI_ALLOW_*_TOOLS = ignored (no sandboxing)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-61437?
The severity of CVE-2026-61437 is rated high with a score of 8.5.
How do I fix CVE-2026-61437?
To fix CVE-2026-61437, update to PraisonAI version 1.6.78 or later.
What type of vulnerability is CVE-2026-61437?
CVE-2026-61437 is a remote code execution vulnerability due to unsafe dynamic module loading.
What software is affected by CVE-2026-61437?
The affected software is the PraisonAI Python package, specifically versions before 1.6.78.
Can CVE-2026-61437 be exploited remotely?
Yes, CVE-2026-61437 can be exploited remotely since it involves dynamic module loading in the framework.