CVE-2026-44339
PraisonAI is a multi-agent teams system. Prior to praisonai version 4.6.37 and praisonaiagents version 1.6.37, praisonaiagents resolves unresolved tool names against module globals and __main__ after it fails to match the declared tool list and the registry. With the default agent configuration, _perm_allow is None, so undeclared non-dangerous tool names are not rejected by the permission gate. An attacker who can influence tool-call names can therefore invoke unintended application callables that were never declared as tools. This issue has been patched in praisonai version 4.6.37 and praisonaiagents version 1.6.37.
- CVSS 3.1
- 8.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L - EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 29% of CVEs (scores of 2026-10-26)
- CWE
- CWE-470
- Published
- Modified
- Record from
- the NVD, synced
Affected
- praison:praisonai
- praison:praisonaiagents
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-gmjg-hv98-qggq | PyPI | praisonaiagents | <1.6.37 | 1.6.37 |
| GHSA-gmjg-hv98-qggq | PyPI | praisonai | <4.6.37 | 4.6.37 |
| PYSEC-2026-2915 | PyPI | praisonai | <4.6.37 | 4.6.37 |
| PYSEC-2026-2948 | PyPI | praisonaiagents | <1.6.37 | 1.6.37 |