CVE-2026-47391
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
PraisonAI before version 4.6.40 includes an example A2A server that exposes an unauthenticated A2A JSON-RPC endpoint and registers a calculate(expression) tool implemented with Python eval(). The server binds to 0.0.0.0. A remote unauthenticated attacker can send message/send to /a2a, causing the LLM to invoke the calculate tool, leading to arbitrary Python execution on the server. The vulnerability affects deployments following the official A2A example or similar unauthenticated A2A deployments with unsafe tools.
Risk Assessment
An attacker can remotely execute arbitrary Python code on the server, leading to full system compromise, data theft, and application takeover.
Recommendation
Update PraisonAI to version 4.6.40 or later, which fixes this vulnerability.
Original NVD description (English source)
PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's first-party A2A server example exposes an unauthenticated A2A JSON-RPC endpoint and registers a `calculate(expression)` tool implemented with Python `eval()`. The example also binds to `0.0.0.0`. A remote unauthenticated attacker can send `message/send` to `/a2a`; the request reaches `agent.chat()`, and a real LLM can invoke the registered `calculate` tool. In testing with `gemini/gemini-2.5-flash-lite`, this resulted in arbitrary Python execution in the server process, confirmed by creation of a marker file from an unauthenticated HTTP request. The issue affects deployments following the official A2A example or similar unauthenticated public A2A deployments with unsafe tools. The default unauthenticated A2A surface also exposes task history and task cancellation APIs, increasing confidentiality and integrity impact. Version 4.6.40 patches the issue.