GHSA-78r8-wwqv-r299: PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334

Summary

PraisonAI's v4.6.32 refactor, which patched CVE-2026-44334 / GHSA-xcmw-grxf-wjhj by adding the PRAISONAI_ALLOW_LOCAL_TOOLS gate to tool_override.py, missed two spec.loader.exec_module call sites in praisonai/agents_generator.py. The functions load_tools_from_module and load_tools_from_module_class pass a module_path from YAML configuration to exec_module with no gate, no allowlist and no validation, and the source says this remains unguarded on master (v4.6.37). A module_path set through a recipe fetched via POST /v1/recipes/run can therefore lead to arbitrary code execution during tool registry construction, before any LLM call.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• InfoResearchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six DaysSimilar attack · The Hacker News
• MediumAn AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.Similar attack · The Hacker News
• LowFBI arrests Saudi OpenAI employee who allegedly planted recording device in conference roomSimilar attack · CNBC Technology
• MediumVisual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)Similar attack · Embrace The Red
• LowAnthropic warns self-replicating AI could spread to your smart devicesSimilar attack · BleepingComputer