---
id: CVE-2026-55522
title: PraisonAI is a multi-agent teams system
summary: >-
  PraisonAI is a multi-agent teams system. In versions 3.9.26 through 4.6.57 of
  praiseonai and 0.12.12 through 1.6.57 of praiseonaiagents, the workflow
  "include" feature is vulnerable to code execution. Workflow._execute_include()
  implicit…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-94
  - CWE-426
  - CWE-829
vendor: praisonaiagents
product: praisonaiagents
affected:
  - 'praisonaiagents >= 0.12.12, < 1.6.58'
  - 'PraisonAI >= 3.9.26, < 4.6.58'
patched:
  - praisonaiagents 1.6.58
  - PraisonAI 4.6.58
published: '2026-08-05'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:51:43.490'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55522'
references:
  - url: >-
      https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-hxmv-c4g6-5fqc
    label: security-advisories@github.com
  - url: >-
      https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-hxmv-c4g6-5fqc
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55522'
  - url: >-
      https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1
  - url: 'https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58'
  - url: 'https://github.com/advisories/GHSA-hxmv-c4g6-5fqc'
  - url: 'https://github.com/MervinPraison/PraisonAI'
  - url: 'https://pypi.org/project/praisonai'
  - url: 'https://pypi.org/project/praisonaiagents'
tags:
  - nvd
  - ghsa
  - pip
  - osv
epss: 0.00224
epssPercentile: 0.11573
aliases:
  - GHSA-hxmv-c4g6-5fqc
  - PYSEC-2026-3891
  - PYSEC-2026-3903
ecosystem: pip
ingestedAt: '2026-08-25T14:27:02.715Z'
---

## Overview

PraisonAI is a multi-agent teams system. In versions 3.9.26 through 4.6.57 of praiseonai and 0.12.12 through 1.6.57 of praiseonaiagents, the workflow "include" feature is vulnerable to code execution. Workflow._execute_include() implicitly imports and runs an included recipe's tools.py via a raw importlib.util.spec_from_file_location() and spec.loader.exec_module() call, without honoring the PRAISONAI_ALLOW_TEMPLATE_TOOLS/PRAISONAI_ALLOW_LOCAL_TOOLS autoload opt-in gates or routing through the centralized safe loader that protects the other tools.py autoload paths. As a result, a workflow that includes an attacker-controlled local recipe directory executes arbitrary module-level Python code during include setup, before any child workflow parsing or model call, and the same sink is reachable through the higher-level praisonai.recipe.run() recipe API. An attacker who can cause a victim process to run a workflow or recipe that includes an untrusted local recipe achieves arbitrary Python code execution as the PraisonAI process user, a variant that bypasses the hardening applied to the previously disclosed automatic tools.py RCE advisory family. This issue has been fixed in version 4.6.58 of praisonai and 1.6.58 of praisonaiagents.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-55522)

Affected packages:

- `praisonaiagents >= 0.12.12, < 1.6.58`
- `PraisonAI >= 3.9.26, < 4.6.58`

Patched in:

- `praisonaiagents 1.6.58`
- `PraisonAI 4.6.58`

Source: https://github.com/advisories/GHSA-hxmv-c4g6-5fqc