PraisonAI CVE-2026-55522

Exploitation requires two concurrent conditions: first, the attacker must be able to place or manipulate a tools.py file in a local recipe directory accessible to the target host's filesystem (e.g., through a shared mount, a cloned untrusted repository, or a prior write primitive); second, a victim operator or automated pipeline must invoke a PraisonAI workflow or call praisonai.recipe.run() with an include directive referencing that attacker-controlled directory (UI:R per CVSS). No authentication to PraisonAI itself is required by the attacker. The vulnerability is NOT reachable from a remote, unauthenticated network position without first achieving local file placement. Exploitation is further limited to environments running praisonai 3.9.26-4.6.57 or praisonaiagents 0.12.12-1.6.57. The critical limiting factor for defenders is the include directive: workflows that exclusively reference internal, access-controlled recipe directories are not exploitable through this path.

The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately reflects a local code-injection primitive that requires the victim operator to actively run a workflow referencing an attacker-controlled recipe directory - hence UI:R and AV:L. The AC:L rating is appropriate because once the attacker places a malicious tools.py in the target directory, no further complexity is needed. The PR:N metric reflects that the attacker requires no authenticated access to the PraisonAI application itself, though they must independently achieve write access to a local path the victim will include. Full C:H/I:H/A:H impact is consistent with arbitrary Python execution at process privilege. No EPSS score was provided in the source data; given the niche deployment footprint and the UI:R gating condition, real-world exploitation risk is lower than the raw CVSS would suggest for broad, opportunistic attacks. However, the bypass-of-hardening nature is significant: defenders who believed the ALLOW_TEMPLATE_TOOLS/ALLOW_LOCAL_TOOLS gates were sufficient mitigations for the prior advisory family must treat this as a residual gap, not a new unrelated risk. No KEV listing and no public POC have been identified, but the precise description in the GitHub Security Advisory provides enough technical detail for a skilled researcher to reproduce the issue.

An attacker who can write a malicious tools.py to a directory on the target host - for example via a compromised shared filesystem, a social-engineering lure that tricks an operator into cloning an attacker-controlled repository, or a prior low-privilege foothold - crafts module-level Python code (e.g., a reverse shell or credential harvester) in that file. When the victim operator runs any PraisonAI workflow or recipe that includes the attacker-controlled directory, Workflow._execute_include() unconditionally imports and executes the malicious tools.py before any other workflow processing, achieving arbitrary code execution as the PraisonAI process user. No public proof-of-concept exploit has been identified, but the advisory description provides sufficient detail to reproduce the technique.