{"cve":"CVE-2026-47391","nvd":{"published":"2026-07-21T16:17:11.920","modified":"2026-10-24T20:10:00.137","status":"Deferred","description":"PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's first-party A2A server example exposes an unauthenticated A2A JSON-RPC endpoint and registers a `calculate(expression)` tool implemented with Python `eval()`. The example also binds to `0.0.0.0`. A remote unauthenticated attacker can send `message/send` to `/a2a`; the request reaches `agent.chat()`, and a real LLM can invoke the registered `calculate` tool. In testing with `gemini/gemini-2.5-flash-lite`, this resulted in arbitrary Python execution in the server process, confirmed by creation of a marker file from an unauthenticated HTTP request. The issue affects deployments following the official A2A example or similar unauthenticated public A2A deployments with unsafe tools. The default unauthenticated A2A surface also exposes task history and task cancellation APIs, increasing confidentiality and integrity impact. Version 4.6.40 patches the issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-95","CWE-306"],"references":["https://github.com/MervinPraison/PraisonAI/commit/e0fb8e7dd1ee6759c18ed07f436c21dbd9c20747","https://github.com/MervinPraison/PraisonAI/pull/1793","https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vg22-4gmj-prxw","https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vg22-4gmj-prxw"],"products":[],"source":"nvd","synced_at":"2026-10-25T17:50:08.599881581+00:00"},"epss":{"cve":"CVE-2026-47391","score":0.01165,"percentile":0.67066,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-vg22-4gmj-prxw","url":"https://osv.dev/vulnerability/GHSA-vg22-4gmj-prxw","summary":"PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution","modified":"2026-06-29T12:26:23.994703049Z","packages":[{"ecosystem":"PyPI","name":"praisonai","purl":"pkg:pypi/praisonai","ranges":["<4.6.40"],"fixed":["4.6.40"]}]},{"id":"PYSEC-2026-478","url":"https://osv.dev/vulnerability/PYSEC-2026-478","summary":"PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution","modified":"2026-07-13T16:15:33.187039504Z","packages":[{"ecosystem":"PyPI","name":"praisonai","purl":"pkg:pypi/praisonai","ranges":["<4.6.40"],"fixed":["4.6.40"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}