CVE-2026-44339 PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute
Attackers can execute arbitrary application callables by manipulating tool names in PraisonAI agents due to unsafe global resolution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44339?
CVE-2026-44339 is a high-severity code injection vulnerability in MervinPraison PraisonAI, published on 8 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PraisonAI is a multi-agent teams system. Prior to praisonai version 4.6.37 and praisonaiagents version 1.6.37, praisonaiagents resolves unresolved tool names against module globals and __main__ after it fails to match the declared tool list and the registry. With the default agent configuration, _perm_allow is None, so undeclared non-dangerous tool names are not rejected by the permission gate. An attacker who can influence tool-call names can therefore invoke unintended application callables that were never declared as tools. This issue has been patched in praisonai version 4.6.37 and praisonaiagents version 1.6.37.
Weakness: CWE-470
Which versions are affected by CVE-2026-44339?
6 open source packages ship an affected version, including praisonaiagents, PraisonAI and praisonai. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
praisonaiagents PyPI | All versions | 1.6.37 |
praisonaiagents PyPI | All versions | 1.6.37 |
praisonaiagents PyPI | All versions | 1.6.37 |
PraisonAI PyPI | All versions | 4.6.37 |
praisonai PyPI | All versions | 4.6.37 |
praisonai PyPI | All versions | 4.6.37 |
Products include Praison Praisonai, Praison Praisonaiagents.
How do I fix CVE-2026-44339?
Upgrade praisonaiagents to 1.6.37 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-44339 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44339 exists.
Other vulnerabilities in MervinPraison PraisonAI
- CVE-2026-39888 PraisonAIAgents has a sandbox escape via exception frame traversal in `execute_code` (subprocess mode)
- CVE-2026-41497 Incomplete fix for CVE-2026-34935: Command Injection in MervinPraison/PraisonAI
- CVE-2026-40288 PraisonAI: Critical RCE via `type: job` workflow YAML
- CVE-2026-39890 PraisonAI Affected by Remote Code Execution via YAML Deserialization in Agent Definition Loading
- CVE-2026-34934 PraisonAI: Second-Order SQL Injection in `get_all_user_threads`
Sources
Also known as GHSA-gmjg-hv98-qggq, PYSEC-2026-2915, PYSEC-2026-2948.