CVE-2026-47391 PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution
Unauthenticated attackers can execute arbitrary Python code via the A2A example's eval-based tool, requiring an upgrade to secure the deployment.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47391?
CVE-2026-47391 is a critical code injection vulnerability in MervinPraison PraisonAI, published on 21 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's first-party A2A server example exposes an unauthenticated A2A JSON-RPC endpoint and registers a `calculate(expression)` tool implemented with Python `eval()`. The example also binds to `0.0.0.0`. A remote unauthenticated attacker can send `message/send` to `/a2a`; the request reaches `agent.chat()`, and a real LLM can invoke the registered `calculate` tool. In testing with `gemini/gemini-2.5-flash-lite`, this resulted in arbitrary Python execution in the server process, confirmed by creation of a marker file from an unauthenticated HTTP request. The issue affects deployments following the official A2A example or similar unauthenticated public A2A deployments with unsafe tools. The default unauthenticated A2A surface also exposes task history and task cancellation APIs, increasing confidentiality and integrity impact. Version 4.6.40 patches the issue.
Which versions are affected by CVE-2026-47391?
3 open source packages ship an affected version, including praisonai and PraisonAI.
| Package | Affected | Fixed in |
|---|---|---|
praisonai PyPI | All versions | 4.6.40 |
praisonai PyPI | All versions | 4.6.40 |
PraisonAI PyPI | All versions | 4.6.40 |
How do I fix CVE-2026-47391?
Upgrade praisonai to 4.6.40 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-47391 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-47391 exists.
Sources
Also known as GHSA-vg22-4gmj-prxw, PYSEC-2026-478.