{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "3.9.26"
              },
              {
                "fixed": "4.6.58"
              },
              {
                "fixed": "4.6.57"
              }
            ],
            "source": [
              "AFFECTED_FIELD",
              "DESCRIPTION"
            ]
          },
          "events": [
            {
              "introduced": "62472a2342dfa358a44a1e959ea127c4cc746b29"
            },
            {
              "fixed": "1ad58ca02975ff1398efeda694ea2ab78f20cf3e"
            }
          ],
          "repo": "https://github.com/mervinpraison/praisonai",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-hxmv-c4g6-5fqc"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-426",
      "CWE-829",
      "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55522.json",
    "unresolved_ranges": [
      {
        "extracted_events": [
          {
            "introduced": "0.12.12"
          },
          {
            "fixed": "1.6.58"
          }
        ],
        "source": "AFFECTED_FIELD"
      }
    ]
  },
  "details": "PraisonAI is a multi-agent teams system. In versions 3.9.26 through 4.6.57 of praiseonai and 0.12.12 through 1.6.57 of praiseonaiagents, the workflow \"include\" feature is vulnerable to code execution. Workflow._execute_include() implicitly imports and runs an included recipe's tools.py via a raw importlib.util.spec_from_file_location() and spec.loader.exec_module() call, without honoring the PRAISONAI_ALLOW_TEMPLATE_TOOLS/PRAISONAI_ALLOW_LOCAL_TOOLS autoload opt-in gates or routing through the centralized safe loader that protects the other tools.py autoload paths. As a result, a workflow that includes an attacker-controlled local recipe directory executes arbitrary module-level Python code during include setup, before any child workflow parsing or model call, and the same sink is reachable through the higher-level praisonai.recipe.run() recipe API. An attacker who can cause a victim process to run a workflow or recipe that includes an untrusted local recipe achieves arbitrary Python code execution as the PraisonAI process user, a variant that bypasses the hardening applied to the previously disclosed automatic tools.py RCE advisory family. This issue has been fixed in version 4.6.58 of praisonai and 1.6.58 of praisonaiagents.",
  "id": "CVE-2026-55522",
  "modified": "2026-09-10T03:30:20.785162268Z",
  "published": "2026-08-05T19:01:43.051Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55522.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-hxmv-c4g6-5fqc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55522"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code"
}