fkie_cve-2026-61446

PraisonAI (praisonaiagents) before 1.6.78 contains a remote code execution vulnerability in the plugin manager, which loads and executes arbitrary Python (.py) files from project-level and user-home .praisonai/plugins/ directories using importlib spec_from_file_location() and exec_module() without code signing, integrity verification, or sandboxing. An attacker who can write a malicious .py file to a plugin directory (for example via path traversal, a supply chain attack, or a compromised dependency) achieves arbitrary code execution when the plugin system initializes.

GHSA-m6wp-h223-4c8g — PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification

Affected: PyPI: praisonaiagents

### Summary The plugin manager loads and executes arbitrary `.py` files from `.praisonai/plugins/` directories (both project-level and user home) via `importlib.util.spec_from_file_location()` + `exec_module()` with zero code signing, integrity verification, or sandboxing. Any attacker who can write a file to the plugins directory (via path traversal, supply chain attack, or compromised dependency) achieves arbitrary code execution when the plugin system initializes.

### Details

`src/praisonai-agents/praisonaiagents/plugins/manager.py` (lines 163-196):

```python def _load_plugin_file(self, file_path: Path) -> Optional[Plugin]: module_name = f"praison_plugin_{file_path.stem}_{id(file_path)}" spec = importlib.util.spec_from_file_location(module_name, file_path) module = importlib.util.module_from_spec(spec) sys.modules[module_name] = module spec.loader.exec_module(module) # Executes arbitrary Python code

if hasattr(module, "create_plugin"): return module.create_plugin() # Calls arbitrary function ```

`src/praisonai-agents/praisonaiagents/plugins/discovery.py` (lines 38-39):

```python # Auto-discovery paths: # 1. Project: ./.praisonai/plugins/ # 2. User: ~/.praisonai/plugins/ ```

No code signing, hash verification, or sandboxing is applied. The only validation is checking for a `Plugin Name` field in the file's docstring header.

### PoC

```python from praisonaiagents.plugins.discovery import load_plugin import tempfile, os

# Create a…

Most recent entries from all

fkie_cve-2026-61446

GHSA-m6wp-h223-4c8g — PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification