CVE-2026-47391 PUBLISHED

PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution

Assigner: GitHub_M
Reserved: 19.05.2026 Published: 21.07.2026 Updated: 21.07.2026

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's first-party A2A server example exposes an unauthenticated A2A JSON-RPC endpoint and registers a calculate(expression) tool implemented with Python eval(). The example also binds to 0.0.0.0. A remote unauthenticated attacker can send message/send to /a2a; the request reaches agent.chat(), and a real LLM can invoke the registered calculate tool. In testing with gemini/gemini-2.5-flash-lite, this resulted in arbitrary Python execution in the server process, confirmed by creation of a marker file from an unauthenticated HTTP request. The issue affects deployments following the official A2A example or similar unauthenticated public A2A deployments with unsafe tools. The default unauthenticated A2A surface also exposes task history and task cancellation APIs, increasing confidentiality and integrity impact. Version 4.6.40 patches the issue.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8

Product Status

Vendor MervinPraison
Product PraisonAI
Versions
  • Version < 4.6.40 is affected

References

Problem Types

  • CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') CWE
  • CWE-306: Missing Authentication for Critical Function CWE