Remote Code Execution in PraisonAI Versions 4.5.139 to 4.6.32

CVE-2026-44334

What is CVE-2026-44334?

The PraisonAI multi-agent system has a vulnerability that stems from improper validation of imports in its tool execution framework. Specifically, versions 4.5.139 through 4.6.31 fail to properly guard a crucial import mechanism in 'tool_override.py', allowing attackers to execute arbitrary code remotely. By utilizing the recipe runner mechanism and crafting a malicious recipe that points to local paths or compromised GitHub repositories, an attacker can bypass authentication requirements and potentially execute harmful code on the server.

References