GHSA-xcmw-grxf-wjhj: PraisonAI has unauthenticated RCE via `tool_override.py` (CVE-2026-40287 patch bypass)

Summary

CVE-2026-40287's fix gated tools.py auto-import behind PRAISONAI_ALLOW_LOCAL_TOOLS=true in tool_resolver.py and api/call.py, but a third import sink in praisonai/templates/tool_override.py was not patched. Because the recipe runner reaches that sink on every recipe execution, POST /v1/recipes/run with a recipe value pointing at a local absolute path or a GitHub repo can cause the server to exec_module() an attacker-supplied tools.py, with no authentication or environment opt-in required by default, since SecurityConfig.allow_any_github defaults to True. The source reports a confirmed execution against praisonai 4.6.31 on 2026-04-25.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• InfoMicrosoft Researchers Show AI Agents Can Be Backdoored by Editing Fewer Than 10 NeuronsSimilar attack · The Hacker News
• HighCVE-2026-63651: LiveDocs is a primary-source-first documentation for AI agents. Prior to version 0.7.0, fetch_docs and introspect…Similar attack · NVD/CVE Database
• HighCVE-2026-125271 - AWS API MCP Server Security Policy Bypass via Incorrect Operation Name NormalizationSimilar attack · AWS Security Bulletins
• InfoLocation Matters: Sparse Latent-Variance Attacks for Face Privacy against Diffusion PersonalizationSimilar attack · Arxiv (cs.RO + cs.CV security)
• MediumCVE-2026-83953 GitHub Copilot for Jetbrains Information Disclosure VulnerabilitySimilar attack · MSRC Security Update Guide