PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow
An unsafe dynamic module loading vulnerability allows an attacker who can control a workflow file and a sibling tools.py to execute arbitrary Python code when the workflow is executed.
The vulnerability is located in the workflow structured output resolution logic.
File: src/praisonai-agents/praisonaiagents/workflows/workflows.py
Method: AgentFlow._resolve_pydantic_class
This code is reached during step execution when a step uses a string output_pydantic :
file_path is set automatically by:
WorkflowManager._load_workflow() (used by workspace discovery)
WorkflowManager.create_workflow()
It can also be set manually after load_yaml() :
The exec_module() call has no sandboxing and ignores the PRAISONAI_ALLOW_*_TOOLS environment variables used elsewhere in the project.
Create the following two files in the same directory:
/tmp/attack/attack.yaml
Run the following Python code (adjust the path to your PraisonAI source):
Type: Execution of Untrusted Local Code via Unsafe Dynamic Module Loading.
Affected users include:
Users of WorkflowManager(workspace_path=...) , where workflow discovery automatically sets file_path .
Users of WorkflowManager.create_workflow() .
Applications that load workflows from repositories, templates, shared workflow collections, CI/CD artifacts, or other directories that may contain untrusted files.
During workflow execution, a string output_pydantic reference causes the framework to automatically locate, import, and execute a sibling tools.py file.
As a result, code contained in tools.py executes with the privileges of the workflow runner without requiring an explicit import or user approval step.
Successful exploitation results in arbitrary Python code execution within the workflow process. An attacker may be able to read local files, access secrets available to the process, modify workflow behavior, perform network operations, or execute additional system commands.
This behavior also bypasses the PRAISONAI_ALLOW_TEMPLATE_TOOLS / PRAISONAI_ALLOW_LOCAL_TOOLS protections used elsewhere in the project, allowing code execution through a separate workflow-resolution path.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
