PraisonAI EUVD-2026-28642

Default PraisonAI agent configuration where _perm_allow is set to None (standard out-of-box setting). Attacker must have capability to influence tool-call names passed to PraisonAI agents - achievable through user-controlled prompts in conversational AI interfaces, API parameters in agent automation systems, or manipulated agent-to-agent communications in multi-agent deployments. Exploitation does NOT require: authentication, user interaction beyond normal system use, or non-default configuration. Limiting factors: attacker needs knowledge of callable names in target application's global namespace; exploitation impact constrained by permissions of the Python process running PraisonAI (cannot escape process sandbox without additional vulnerabilities).

The CVSS 8.6 score reflects severe risk with network attack vector (AV:N), low complexity (AC:L), and no authentication required (PR:N/UI:N), indicating straightforward remote exploitation. High integrity impact (I:H) with low confidentiality (C:L) and availability (A:L) impacts aligns with unauthorized function execution that can modify application state and potentially leak data. The vulnerability is particularly dangerous in AI agent systems where tool-call parameters may be influenced by untrusted inputs (user prompts, external data sources). No EPSS or KEV data provided, but the GitHub Security Advisory publication and straightforward exploitation path suggest moderate exploitation likelihood. The attack requires the ability to influence tool-call names, which in multi-agent AI systems may be achievable through prompt injection, API manipulation, or malicious training data. Real-world risk depends heavily on deployment context - systems processing untrusted prompts or integrating with external agents face immediate exploitation risk, while isolated internal deployments have reduced exposure.

An attacker crafts a malicious prompt or API request to an AI agent system using PraisonAI, specifying a tool-call name that references a sensitive internal function (e.g., 'os.system', 'subprocess.run', or application-specific admin functions) instead of a declared tool. The PraisonAI tool resolver fails to match the declared tool list, falls back to module globals/__main__ resolution, and successfully invokes the unintended callable with attacker-controlled parameters. The attacker achieves code execution or state manipulation without authentication, potentially exfiltrating data or modifying application behavior.