Detections
Analytics

SCA: security update for PraisonAI, praisonaiagents (GHSA-hxmv-c4g6-5fqc)

high Tenable Self-Hosted Container Security Plugin ID 446282

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - PraisonAI is a multi-agent teams system. In versions 3.9.26 through 4.6.57 of praiseonai and 0.12.12
 through 1.6.57 of praiseonaiagents, the workflow "include" feature is vulnerable to code execution.
 Workflow._execute_include() implicitly imports and runs an included recipe's tools.py via a raw
 importlib.util.spec_from_file_location() and spec.loader.exec_module() call, without honoring the
 PRAISONAI_ALLOW_TEMPLATE_TOOLS/PRAISONAI_ALLOW_LOCAL_TOOLS autoload opt-in gates or routing through the
 centralized safe loader that protects the other tools.py autoload paths. As a result, a workflow that
 includes an attacker-controlled local recipe directory executes arbitrary module-level Python code during
 include setup, before any child workflow parsing or model call, and the same sink is reachable through the
 higher-level praisonai.recipe.run() recipe API. An attacker who can cause a victim process to run a
 workflow or recipe that includes an untrusted local recipe achieves arbitrary Python code execution as the
 PraisonAI process user, a variant that bypasses the hardening applied to the previously disclosed
 automatic tools.py RCE advisory family. This issue has been fixed in version 4.6.58 of praisonai and
 1.6.58 of praisonaiagents. (CVE-2026-55522)

Solution

Update the praisonaiagents library and its related packages to version 1.6.58 or later.

See Also

https://github.com/advisories/GHSA-hxmv-c4g6-5fqc

Plugin Details

Severity: High

ID: 446282

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 8/25/2026

Updated: 8/25/2026

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.76

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-55522

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/25/2026

Vulnerability Publication Date: 8/5/2026

Reference Information

CVE: CVE-2026-55522