Code Execution Vulnerability in PraisonAI by Mervin Praison
CVE-2026-55522

7.8HIGH

Key Information:

Vendor

Mervinpraison

Status
Praisonai
Praisonaiagents
Vendor
CVE Published:
5 August 2026

What is CVE-2026-55522?

The PraisonAI system is vulnerable due to insecure handling of the workflow 'include' feature, allowing for arbitrary Python code execution. This occurs because the system can import and run code from an attacker-controlled local recipe directory without adequate checks. Specifically, the methods Workflow._execute_include() and praisonai.recipe.run() enable the execution of potentially malicious code during the setup phase of workflow execution. Affected versions include PraisonAI from 3.9.26 to 4.6.57 and PraisonAI Agents from 0.12.12 to 1.6.57. This vulnerability has been remediated in version 4.6.58 of PraisonAI and 1.6.58 of PraisonAI Agents, emphasizing the importance of upgrading to secure these systems.

Affected Version(s)

PraisonAI >= 3.9.26, < 4.6.58

praisonaiagents >= 0.12.12, < 1.6.58

References

https://github.com/MervinPraison/PraisonAI/security/advis...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.