{"data":{"id":"4dccfad7-6500-41d0-9829-338ecf6c46f1","title":"GHSA-vg22-4gmj-prxw: PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution","summary":"The first-party PraisonAI A2A server example combines three behaviors into a remotely exploitable chain: it exposes an A2A server without `auth_token`, binds to `0.0.0.0`, and registers a `calculate(expression)` tool implemented with Python `eval(expression)`. An unauthenticated client can send a JSON-RPC `message/send` request to `/a2a`, which passes the message to `agent.chat()`, and with a real Gemini model the LLM invoked `calculate`, executing Python in the server process. The advisory says the chain is confirmed for the official example and deployments following the same pattern, and that the full chain is only claimed for versions where the `/a2a` endpoint is present and confirmed.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-vg22-4gmj-prxw","publishedAt":"2026-05-29T22:31:26.000Z","cveId":"CVE-2026-47391","cweIds":null,"cvssScore":null,"cvssSeverity":"critical","severity":"critical","attackType":["jailbreak","other"],"issueType":"vulnerability","affectedPackages":["PraisonAI@<= 4.6.39 (fixed: 4.6.40)"],"affectedPackageNames":["praisonai"],"affectedPackageRefs":["pypi:praisonai"],"affectedVendors":["Google"],"affectedVendorsRaw":["PraisonAI","A2A","Gemini","gemini-2.5-flash-lite"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.01165,"epssCheckedAt":"2026-10-14T06:09:07.174Z","kevDateAdded":null,"advisoryAliases":["GHSA-vg22-4gmj-prxw"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-05-29T22:31:26.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0054"]}}