PraisonAI, a multi-agent teams system, prior to version 4.5.128, implicitly loads and executes a tools.py file from the current working directory using importlib.util.spec_from_file_location and spec.loader.exec_module() without explicit user consent, validation, or sandboxing. This automatic loading occurs even if tools.py is not referenced in configuration files. Consequently, placing a malicious tools.py file in the working directory leads to immediate arbitrary code execution upon startup, before any agent logic runs. This behavior breaches the security boundary between user-controlled project files and executable code. The vulnerability is identified as CWE-94 (Improper Control of Generation of Code) and is fixed in version 4.5.128.

An attacker who can place a malicious tools.py file in the working directory where PraisonAI is executed can achieve arbitrary code execution with the privileges of the user running the software. This can lead to full compromise of the affected system, including confidentiality, integrity, and availability impacts. The vulnerability is exploitable locally or via scenarios where an attacker can influence the working directory contents. No known exploits in the wild have been reported.

This vulnerability is fixed in PraisonAI version 4.5.128. Users should upgrade to version 4.5.128 or later to remediate this issue. Until upgrading, ensure that untrusted users cannot place files named tools.py in directories where PraisonAI is executed. Restrict write permissions on working directories and validate the environment before running the software. Patch status is not explicitly confirmed beyond the stated fix in version 4.5.128; users should consult the vendor for official advisories.