PraisonAI's unauthenticated A2A official example can reach real LLM-driven eval() tool execution

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

• CVE-2026-47391: 1.50% estimated exploitation activity in the next 30 days; percentile 74.27 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary The first-party PraisonAI A2A server example combines three behaviors into a remotely exploitable Critical chain: 1. The example exposes an A2A server without configuring authtoken. 2. The same example binds the server to 0.0.0.0. 3. The example registers a calculate(expression) tool implemented with Python eval(expression). An unauthenticated network client can send a JSON-RPC message/send request to /a2a. The A2A handler passes the attacker-controlled message to agent.chat(). With a real Gemini LLM (gemini/gemini-2.5-flash-lite), the model invoked the registered calculate tool, causing the example's eval() call to execute Python in the server process. The canary wrote a marker file from an unauthenticated /a2a request. This is not a claim that every A2A deployment is automatically RCE. The Critical chain is confirmed for the first-party A2A example, and for deployments that follow the same pattern: public unauthenticated A2A plus an unsafe tool such as this eval()-based…

Published by the source

29 May 2026, 22:31 UTC

Last modified by the source

29 Jun 2026, 12:26 UTC

Source last checked

26 Oct 2026, 13:41 UTC

1. Revision 3 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-vg22-4gmj-prxw

2. Revision 2 · amended · 24 Oct 2026

   Amended from osv record GHSA-vg22-4gmj-prxw

3. Revision 1 · created · 23 Oct 2026

   Published from ghsa record GHSA-vg22-4gmj-prxw

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-47391

Advisory: PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution
IDs: CVE-2026-47391, GHSA-vg22-4gmj-prxw
Record: https://patchnext.com/advisories/cve-2026-47391 (revision 3, source checked 26 Oct 2026, 13:41 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Critical (CVSS 9.8)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: praisonai 4.6.40. A vendor fix does not mean a deployment is fixed.

## Affected components
- PyPI praisonai: affected <= 4.6.39; fixed in 4.6.40

## Suggested inspection (read-only)
- `python -m pip show praisonai`: prints the installed version. Run with the environment that serves production active.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on praisonai.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-vg22-4gmj-prxw (GitHub-reviewed advisory GHSA-vg22-4gmj-prxw lists affected ranges: PyPI praisonai >=0 <=4.6.39)
- Verified: https://osv.dev/vulnerability/GHSA-vg22-4gmj-prxw (OSV record GHSA-vg22-4gmj-prxw lists affected ranges: PyPI praisonai >=0 <4.6.40 (fixed))

Commands are suggestions: review each one before running it.