Skip to content
AI Sec Watch
CriticalVulnerabilityLLM-specific

GHSA-vg22-4gmj-prxw: PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution

Source
GitHub Advisory(opens in a new tab)
Identifiers
CVE-2026-47391GHSA-vg22-4gmj-prxw
Published
Record updated
View JSON
Affected
  • PraisonAI <= 4.6.39
Fixed in
4.6.40
Known exploitation
Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS
1.2%

Summary

The first-party PraisonAI A2A server example combines three behaviors into a remotely exploitable chain: it exposes an A2A server without `auth_token`, binds to `0.0.0.0`, and registers a `calculate(expression)` tool implemented with Python `eval(expression)`. An unauthenticated client can send a JSON-RPC `message/send` request to `/a2a`, which passes the message to `agent.chat()`, and with a real Gemini model the LLM invoked `calculate`, executing Python in the server process. The advisory says the chain is confirmed for the official example and deployments following the same pattern, and that the full chain is only claimed for versions where the `/a2a` endpoint is present and confirmed.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Topics

Related items