https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 17:06:56 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-290874 EUVD-2026-290874 https://cve.radiocsirt.org/vuln/euvd-2026-290874 https://cve.radiocsirt.org/vuln/fkie_cve-2026-40156 <p>PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI automatically loads a file named tools.py from the current working directory to discover and register custom agent tools. This loading process uses importlib.util.spec_from_file_location and immediately executes module-level code via spec.loader.exec_module() without explicit user consent, validation, or sandboxing. The tools.py file is loaded implicitly, even when it is not referenced in configuration files or explicitly requested by the user. As a result, merely placing a file named tools.py in the working directory is sufficient to trigger code execution. This behavior violates the expected security boundary between user-controlled project files (e.g., YAML configurations) and executable code, as untrusted content in the working directory is treated as trusted and executed automatically. If an attacker can place a malicious tools.py file into a directory where a user or automated system (e.g., CI/CD pipeline) runs praisonai, arbitrary code execution occurs immediately upon startup, before any agent logic begins. This vulnerability is fixed in 4.5.128.</p> <p>PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI automatically loads a file named tools.py from the current working directory to discover and register custom agent tools. This loading process uses importlib.util.spec_from_file_location and immediately executes module-level code via spec.loader.exec_module() without explicit user consent, validation, or sandboxing. The tools.py file is loaded implicitly, even when it is not referenced in configuration files or explicitly requested by the user. As a result, merely placing a file named tools.py in the working directory is sufficient to trigger code execution. This behavior violates the expected security boundary between user-controlled project files (e.g., YAML configurations) and executable code, as untrusted content in the working directory is treated as trusted and executed automatically. If an attacker can place a malicious tools.py file into a directory where a user or automated system (e.g., CI/CD pipeline) runs praisonai, arbitrary code execution occurs immediately upon startup, before any agent logic begins. This vulnerability is fixed in 4.5.128.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-40156 https://cve.radiocsirt.org/vuln/ghsa-2g3w-cpc4-chr4 <p><strong>Affected:</strong> PyPI: praisonai</p> <p>PraisonAI automatically loads a file named `tools.py` from the current working directory to discover and register custom agent tools. This loading process uses `importlib.util.spec_from_file_location` and immediately executes module-level code via `spec.loader.exec_module()` **without explicit user consent, validation, or sandboxing**.</p> <p>The `tools.py` file is loaded **implicitly**, even when it is not referenced in configuration files or explicitly requested by the user. As a result, merely placing a file named `tools.py` in the working directory is sufficient to trigger code execution.</p> <p>This behavior violates the expected security boundary between **user-controlled project files** (e.g., YAML configurations) and **executable code**, as untrusted content in the working directory is treated as trusted and executed automatically.</p> <p>If an attacker can place a malicious `tools.py` file into a directory where a user or automated system (e.g., CI/CD pipeline) runs `praisonai`, arbitrary code execution occurs immediately upon startup, before any agent logic begins.</p> <p>---</p> <p>## Vulnerable Code Location</p> <p>`src/praisonai/praisonai/tool_resolver.py` → `ToolResolver._load_local_tools`</p> <p>```python tools_path = Path(self._tools_py_path) # defaults to &#34;tools.py&#34; in CWD ... spec = importlib.util.spec_from_file_location(&#34;tools&#34;, str(tools_path)) module = importlib.util.module_from_spec(spec) spec.loader.exec_module(module) # Executes arbitrary code ```</p> <p>---</p> <p>## Reproducing the Attack</p> <p>1. Create…</p> <p><strong>Affected:</strong> PyPI: praisonai</p> <p>PraisonAI automatically loads a file named `tools.py` from the current working directory to discover and register custom agent tools. This loading process uses `importlib.util.spec_from_file_location` and immediately executes module-level code via `spec.loader.exec_module()` **without explicit user consent, validation, or sandboxing**.</p> <p>The `tools.py` file is loaded **implicitly**, even when it is not referenced in configuration files or explicitly requested by the user. As a result, merely placing a file named `tools.py` in the working directory is sufficient to trigger code execution.</p> <p>This behavior violates the expected security boundary between **user-controlled project files** (e.g., YAML configurations) and **executable code**, as untrusted content in the working directory is treated as trusted and executed automatically.</p> <p>If an attacker can place a malicious `tools.py` file into a directory where a user or automated system (e.g., CI/CD pipeline) runs `praisonai`, arbitrary code execution occurs immediately upon startup, before any agent logic begins.</p> <p>---</p> <p>## Vulnerable Code Location</p> <p>`src/praisonai/praisonai/tool_resolver.py` → `ToolResolver._load_local_tools`</p> <p>```python tools_path = Path(self._tools_py_path) # defaults to &#34;tools.py&#34; in CWD ... spec = importlib.util.spec_from_file_location(&#34;tools&#34;, str(tools_path)) module = importlib.util.module_from_spec(spec) spec.loader.exec_module(module) # Executes arbitrary code ```</p> <p>---</p> <p>## Reproducing the Attack</p> <p>1. Create…</p> https://cve.radiocsirt.org/vuln/ghsa-2g3w-cpc4-chr4 https://cve.radiocsirt.org/vuln/pysec-2026-2895 <p><strong>Affected:</strong> PyPI: praisonai</p> <p>PraisonAI automatically loads a file named `tools.py` from the current working directory to discover and register custom agent tools. This loading process uses `importlib.util.spec_from_file_location` and immediately executes module-level code via `spec.loader.exec_module()` **without explicit user consent, validation, or sandboxing**.</p> <p>The `tools.py` file is loaded **implicitly**, even when it is not referenced in configuration files or explicitly requested by the user. As a result, merely placing a file named `tools.py` in the working directory is sufficient to trigger code execution.</p> <p>This behavior violates the expected security boundary between **user-controlled project files** (e.g., YAML configurations) and **executable code**, as untrusted content in the working directory is treated as trusted and executed automatically.</p> <p>If an attacker can place a malicious `tools.py` file into a directory where a user or automated system (e.g., CI/CD pipeline) runs `praisonai`, arbitrary code execution occurs immediately upon startup, before any agent logic begins.</p> <p>---</p> <p>## Vulnerable Code Location</p> <p>`src/praisonai/praisonai/tool_resolver.py` → `ToolResolver._load_local_tools`</p> <p>```python tools_path = Path(self._tools_py_path) # defaults to &#34;tools.py&#34; in CWD ... spec = importlib.util.spec_from_file_location(&#34;tools&#34;, str(tools_path)) module = importlib.util.module_from_spec(spec) spec.loader.exec_module(module) # Executes arbitrary code ```</p> <p>---</p> <p>## Reproducing the Attack</p> <p>1. Create…</p> <p><strong>Affected:</strong> PyPI: praisonai</p> <p>PraisonAI automatically loads a file named `tools.py` from the current working directory to discover and register custom agent tools. This loading process uses `importlib.util.spec_from_file_location` and immediately executes module-level code via `spec.loader.exec_module()` **without explicit user consent, validation, or sandboxing**.</p> <p>The `tools.py` file is loaded **implicitly**, even when it is not referenced in configuration files or explicitly requested by the user. As a result, merely placing a file named `tools.py` in the working directory is sufficient to trigger code execution.</p> <p>This behavior violates the expected security boundary between **user-controlled project files** (e.g., YAML configurations) and **executable code**, as untrusted content in the working directory is treated as trusted and executed automatically.</p> <p>If an attacker can place a malicious `tools.py` file into a directory where a user or automated system (e.g., CI/CD pipeline) runs `praisonai`, arbitrary code execution occurs immediately upon startup, before any agent logic begins.</p> <p>---</p> <p>## Vulnerable Code Location</p> <p>`src/praisonai/praisonai/tool_resolver.py` → `ToolResolver._load_local_tools`</p> <p>```python tools_path = Path(self._tools_py_path) # defaults to &#34;tools.py&#34; in CWD ... spec = importlib.util.spec_from_file_location(&#34;tools&#34;, str(tools_path)) module = importlib.util.module_from_spec(spec) spec.loader.exec_module(module) # Executes arbitrary code ```</p> <p>---</p> <p>## Reproducing the Attack</p> <p>1. Create…</p> https://cve.radiocsirt.org/vuln/pysec-2026-2895