https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 10:59:56 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-47398 <p>PraisonAI is a multi-agent teams system. The v4.6.32 chokepoint refactor (which patched CVE-2026-44334 / GHSA-xcmw-grxf-wjhj) added the PRAISONAI_ALLOW_LOCAL_TOOLS env-var gate to the tool_override.py sinks. However, two additional spec.loader.exec_module call sites in praisonai/agents_generator.py were missed and remain completely unguarded in versions prior to 4.6.40. Both functions accept a module_path parameter sourced from YAML configuration and execute it without validation, signature checking, or the env-var gate. Version 4.6.40 fixes the issue.</p> <p>PraisonAI is a multi-agent teams system. The v4.6.32 chokepoint refactor (which patched CVE-2026-44334 / GHSA-xcmw-grxf-wjhj) added the PRAISONAI_ALLOW_LOCAL_TOOLS env-var gate to the tool_override.py sinks. However, two additional spec.loader.exec_module call sites in praisonai/agents_generator.py were missed and remain completely unguarded in versions prior to 4.6.40. Both functions accept a module_path parameter sourced from YAML configuration and execute it without validation, signature checking, or the env-var gate. Version 4.6.40 fixes the issue.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-47398 https://vulnerability.circl.lu/vuln/ghsa-78r8-wwqv-r299 <p><strong>Affected:</strong> PyPI: PraisonAI</p> <p>&lt;html&gt;&lt;head&gt;&lt;/head&gt;&lt;body&gt;&lt;h2&gt;Arbitrary code execution via ungated &lt;code&gt;spec.loader.exec_module&lt;/code&gt; in &lt;code&gt;agents_generator.py&lt;/code&gt; (v4.6.32 chokepoint refactor bypass)&lt;/h2&gt; &lt;h3&gt;Summary&lt;/h3&gt; &lt;p&gt;The v4.6.32 chokepoint refactor (which patched CVE-2026-44334 / GHSA-xcmw-grxf-wjhj) added the &lt;code&gt;PRAISONAI_ALLOW_LOCAL_TOOLS&lt;/code&gt; env-var gate to the &lt;code&gt;tool_override.py&lt;/code&gt; sinks. However, &lt;strong&gt;two additional &lt;code&gt;spec.loader.exec_module&lt;/code&gt; call sites&lt;/strong&gt; in &lt;code&gt;praisonai/agents_generator.py&lt;/code&gt; were missed and remain completely unguarded on current &lt;code&gt;master&lt;/code&gt; (v4.6.37). Both functions accept a &lt;code&gt;module_path&lt;/code&gt; parameter sourced from YAML configuration and execute it without validation, signature checking, or the env-var gate.&lt;/p&gt; &lt;h3&gt;Patch lineage&lt;/h3&gt;</p> <p>CVE | GHSA | Fixed in | What was patched -- | -- | -- | -- CVE-2026-40156 | GHSA-2g3w-cpc4-chr4 | 4.5.128 | CWD tools.py auto-load in tool_resolver.py CVE-2026-40287 | GHSA-g985-wjh9-qxxc | 4.5.139 | Env-var gate added to tool_resolver.py + api/call.py CVE-2026-44334 | GHSA-xcmw-grxf-wjhj | 4.6.32 | Missed sink in templates/tool_override.py This finding | — | unfixed | Missed sinks in agents_generator.py</p> <p>&lt;p&gt;Every prior patch addressed a subset of &lt;code&gt;exec_module&lt;/code&gt; call sites. The two sinks documented here were present throughout the entire fix sequence and remain unpatched.&lt;/p&gt; &lt;h3&gt;Vulnerable code&lt;/h3&gt; &lt;pre&gt;&lt;code class=&#34;language-python&#34;&gt;# praisonai/agents_generator.py (m…</p> <p><strong>Affected:</strong> PyPI: PraisonAI</p> <p>&lt;html&gt;&lt;head&gt;&lt;/head&gt;&lt;body&gt;&lt;h2&gt;Arbitrary code execution via ungated &lt;code&gt;spec.loader.exec_module&lt;/code&gt; in &lt;code&gt;agents_generator.py&lt;/code&gt; (v4.6.32 chokepoint refactor bypass)&lt;/h2&gt; &lt;h3&gt;Summary&lt;/h3&gt; &lt;p&gt;The v4.6.32 chokepoint refactor (which patched CVE-2026-44334 / GHSA-xcmw-grxf-wjhj) added the &lt;code&gt;PRAISONAI_ALLOW_LOCAL_TOOLS&lt;/code&gt; env-var gate to the &lt;code&gt;tool_override.py&lt;/code&gt; sinks. However, &lt;strong&gt;two additional &lt;code&gt;spec.loader.exec_module&lt;/code&gt; call sites&lt;/strong&gt; in &lt;code&gt;praisonai/agents_generator.py&lt;/code&gt; were missed and remain completely unguarded on current &lt;code&gt;master&lt;/code&gt; (v4.6.37). Both functions accept a &lt;code&gt;module_path&lt;/code&gt; parameter sourced from YAML configuration and execute it without validation, signature checking, or the env-var gate.&lt;/p&gt; &lt;h3&gt;Patch lineage&lt;/h3&gt;</p> <p>CVE | GHSA | Fixed in | What was patched -- | -- | -- | -- CVE-2026-40156 | GHSA-2g3w-cpc4-chr4 | 4.5.128 | CWD tools.py auto-load in tool_resolver.py CVE-2026-40287 | GHSA-g985-wjh9-qxxc | 4.5.139 | Env-var gate added to tool_resolver.py + api/call.py CVE-2026-44334 | GHSA-xcmw-grxf-wjhj | 4.6.32 | Missed sink in templates/tool_override.py This finding | — | unfixed | Missed sinks in agents_generator.py</p> <p>&lt;p&gt;Every prior patch addressed a subset of &lt;code&gt;exec_module&lt;/code&gt; call sites. The two sinks documented here were present throughout the entire fix sequence and remain unpatched.&lt;/p&gt; &lt;h3&gt;Vulnerable code&lt;/h3&gt; &lt;pre&gt;&lt;code class=&#34;language-python&#34;&gt;# praisonai/agents_generator.py (m…</p> https://vulnerability.circl.lu/vuln/ghsa-78r8-wwqv-r299 https://vulnerability.circl.lu/vuln/pysec-2026-2905 <p><strong>Affected:</strong> PyPI: praisonai</p> <p>&lt;html&gt;&lt;head&gt;&lt;/head&gt;&lt;body&gt;&lt;h2&gt;Arbitrary code execution via ungated &lt;code&gt;spec.loader.exec_module&lt;/code&gt; in &lt;code&gt;agents_generator.py&lt;/code&gt; (v4.6.32 chokepoint refactor bypass)&lt;/h2&gt; &lt;h3&gt;Summary&lt;/h3&gt; &lt;p&gt;The v4.6.32 chokepoint refactor (which patched CVE-2026-44334 / GHSA-xcmw-grxf-wjhj) added the &lt;code&gt;PRAISONAI_ALLOW_LOCAL_TOOLS&lt;/code&gt; env-var gate to the &lt;code&gt;tool_override.py&lt;/code&gt; sinks. However, &lt;strong&gt;two additional &lt;code&gt;spec.loader.exec_module&lt;/code&gt; call sites&lt;/strong&gt; in &lt;code&gt;praisonai/agents_generator.py&lt;/code&gt; were missed and remain completely unguarded on current &lt;code&gt;master&lt;/code&gt; (v4.6.37). Both functions accept a &lt;code&gt;module_path&lt;/code&gt; parameter sourced from YAML configuration and execute it without validation, signature checking, or the env-var gate.&lt;/p&gt; &lt;h3&gt;Patch lineage&lt;/h3&gt;</p> <p>CVE | GHSA | Fixed in | What was patched -- | -- | -- | -- CVE-2026-40156 | GHSA-2g3w-cpc4-chr4 | 4.5.128 | CWD tools.py auto-load in tool_resolver.py CVE-2026-40287 | GHSA-g985-wjh9-qxxc | 4.5.139 | Env-var gate added to tool_resolver.py + api/call.py CVE-2026-44334 | GHSA-xcmw-grxf-wjhj | 4.6.32 | Missed sink in templates/tool_override.py This finding | — | unfixed | Missed sinks in agents_generator.py</p> <p>&lt;p&gt;Every prior patch addressed a subset of &lt;code&gt;exec_module&lt;/code&gt; call sites. The two sinks documented here were present throughout the entire fix sequence and remain unpatched.&lt;/p&gt; &lt;h3&gt;Vulnerable code&lt;/h3&gt; &lt;pre&gt;&lt;code class=&#34;language-python&#34;&gt;# praisonai/agents_generator.py (m…</p> <p><strong>Affected:</strong> PyPI: praisonai</p> <p>&lt;html&gt;&lt;head&gt;&lt;/head&gt;&lt;body&gt;&lt;h2&gt;Arbitrary code execution via ungated &lt;code&gt;spec.loader.exec_module&lt;/code&gt; in &lt;code&gt;agents_generator.py&lt;/code&gt; (v4.6.32 chokepoint refactor bypass)&lt;/h2&gt; &lt;h3&gt;Summary&lt;/h3&gt; &lt;p&gt;The v4.6.32 chokepoint refactor (which patched CVE-2026-44334 / GHSA-xcmw-grxf-wjhj) added the &lt;code&gt;PRAISONAI_ALLOW_LOCAL_TOOLS&lt;/code&gt; env-var gate to the &lt;code&gt;tool_override.py&lt;/code&gt; sinks. However, &lt;strong&gt;two additional &lt;code&gt;spec.loader.exec_module&lt;/code&gt; call sites&lt;/strong&gt; in &lt;code&gt;praisonai/agents_generator.py&lt;/code&gt; were missed and remain completely unguarded on current &lt;code&gt;master&lt;/code&gt; (v4.6.37). Both functions accept a &lt;code&gt;module_path&lt;/code&gt; parameter sourced from YAML configuration and execute it without validation, signature checking, or the env-var gate.&lt;/p&gt; &lt;h3&gt;Patch lineage&lt;/h3&gt;</p> <p>CVE | GHSA | Fixed in | What was patched -- | -- | -- | -- CVE-2026-40156 | GHSA-2g3w-cpc4-chr4 | 4.5.128 | CWD tools.py auto-load in tool_resolver.py CVE-2026-40287 | GHSA-g985-wjh9-qxxc | 4.5.139 | Env-var gate added to tool_resolver.py + api/call.py CVE-2026-44334 | GHSA-xcmw-grxf-wjhj | 4.6.32 | Missed sink in templates/tool_override.py This finding | — | unfixed | Missed sinks in agents_generator.py</p> <p>&lt;p&gt;Every prior patch addressed a subset of &lt;code&gt;exec_module&lt;/code&gt; call sites. The two sinks documented here were present throughout the entire fix sequence and remain unpatched.&lt;/p&gt; &lt;h3&gt;Vulnerable code&lt;/h3&gt; &lt;pre&gt;&lt;code class=&#34;language-python&#34;&gt;# praisonai/agents_generator.py (m…</p> https://vulnerability.circl.lu/vuln/pysec-2026-2905