What is the CVSS score of CVE-2026-44339?

CVE-2026-44339 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L. EPSS exploitation probability: 0.1%.

Which versions of PraisonAI are affected by CVE-2026-44339?

PraisonAI versions prior to 4.6.37 contain a critical vulnerability allowing remote attackers to execute arbitrary functions on systems running multi-agent applications, bypassing all tool access…. A patch is available.

How to fix or mitigate CVE-2026-44339?

Within 24 hours: identify all systems running praisonai <4.6.37 or praisonaiagents <1.6.37 via dependency scanning and isolate affected instances from production networks. Within 7 days: upgrade to praisonai 4.6.37 or praisonaiagents 1.6.37 on all affected systems and validate tool declaration controls are enforced. Within 30 days: conduct post-upgrade security testing of multi-agent workflows and review logs for indicators of exploitation attempts.

PraisonAI CVE-2026-44339

EUVD-2026-28642 HIGH

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') (CWE-470)

2026-05-08 security-advisories@github.com

GHSA-gmjg-hv98-qggq

Information Disclosure Praisonaiagents Praisonai Praison

8.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

May 08, 2026 - 15:17 EUVD

Analysis Generated

May 08, 2026 - 15:01 vuln.today

CVE Published

May 08, 2026 - 14:16 nvd

HIGH 8.6

DescriptionGitHub Advisory

PraisonAI is a multi-agent teams system. Prior to praisonai version 4.6.37 and praisonaiagents version 1.6.37, praisonaiagents resolves unresolved tool names against module globals and __main__ after it fails to match the declared tool list and the registry. With the default agent configuration, _perm_allow is None, so undeclared non-dangerous tool names are not rejected by the permission gate. An attacker who can influence tool-call names can therefore invoke unintended application callables that were never declared as tools. This issue has been patched in praisonai version 4.6.37 and praisonaiagents version 1.6.37.

AnalysisAI

Remote attackers can invoke arbitrary application callables in PraisonAI multi-agent systems by manipulating tool-call names to bypass tool declaration controls. Vulnerable versions (praisonai <4.6.37, praisonaiagents <1.6.37) resolve unmatched tool names against module globals and __main__ namespaces without permission validation when _perm_allow is None (default configuration). This enables unauthorized function execution beyond the intended tool list, allowing integrity compromise and potential information disclosure. Patched versions 4.6.37 and 1.6.37 address the tool name resolution vulnerability.

Technical ContextAI

PraisonAI is a multi-agent AI orchestration framework that manages tool execution through declared tool registries. The vulnerability stems from CWE-470 (Use of Externally-Controlled Input to Select Classes or Code), where the tool resolution mechanism falls back to Python's module globals() and __main__ namespace after exhausting the declared tool list and registry. With the default _perm_allow=None configuration, the permission gate does not reject tool names that don't match dangerous patterns, creating a type confusion vulnerability. An attacker who controls tool-call names (potentially through prompt injection or API parameter manipulation) can reference any callable object in the application's global namespace, effectively bypassing the intended tool sandboxing and executing arbitrary Python functions that were never intended as agent tools.

RemediationAI

Upgrade immediately to patched versions: praisonai 4.6.37 or later and praisonaiagents 1.6.37 or later, both released to address this vulnerability per GitHub Security Advisory GHSA-gmjg-hv98-qggq (https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-gmjg-hv98-qggq). If immediate patching is not feasible, implement strict input validation on all tool-call name parameters, configure explicit _perm_allow whitelists to reject undeclared tool names, and review application code to ensure sensitive callables are not exposed in module globals or __main__ namespaces. Compensating controls: implement monitoring for unexpected function calls outside declared tool lists, restrict agent access to network resources to limit lateral movement if exploitation occurs, and validate all tool invocations against an explicit allowlist before execution (note this adds significant operational overhead and may break legitimate tool discovery features).