PT-2026-45057 · Praisonai · Praisonai

CVE-2026-47398 · Published 2026-05-29 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.40

Description PraisonAI is a multi-agent teams system. The software contains unguarded spec.loader.exec module call sites within praisonai/agents generator.py. Two functions in this file accept a module path parameter sourced from YAML configuration and execute it without validation, signature checking, or the required environment variable gate.

Recommendations Update to version 4.6.40.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-829

CWE-94

Related Identifiers

CVE-2026-47398

GHSA-78R8-WWQV-R299

PYSEC-2026-2905

Affected Products

Praisonai

References · 11

• 🔥 https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-78r8-wwqv-r299 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47398.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-47398 · Security Note
• https://osv.dev/vulnerability/CVE-2026-47398 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-78r8-wwqv-r299 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-2905 · Vendor Advisory
• https://github.com/MervinPraison/PraisonAI/commit/ef79b7a0561796ad9807f0f09538c25cc78d3619 · Note
• https://github.com/MervinPraison/PraisonAI/pull/1685 · Note
• https://github.com/MervinPraison/PraisonAI · Note
• https://pypi.org/project/praisonai · Note
• https://github.com/advisories/GHSA-78r8-wwqv-r299 · Note