PraisonAI versions before 4.6.37 and praisonaiagents before 1.6.37 contain an unsafe reflection vulnerability (CWE-470) where unresolved tool names are resolved against module globals and __main__ if not found in the declared tool list or registry. The default configuration (_perm_allow is None) does not prevent undeclared tool names from being used, allowing attackers who can influence tool-call names to invoke unintended application callables. This can lead to unauthorized code execution or manipulation within the application context. The vulnerability has a CVSS 3.1 score of 8.6 (high severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality (low), integrity (high), and availability (low). The issue is fixed in PraisonAI 4.6.37 and praisonaiagents 1.6.37.

An attacker able to control tool-call names can invoke unintended application callables that were never declared as tools, potentially leading to unauthorized code execution or manipulation of application behavior. The vulnerability impacts confidentiality, integrity, and availability to varying degrees as indicated by the CVSS vector. No known exploits in the wild have been reported.

A fix is available in PraisonAI version 4.6.37 and praisonaiagents version 1.6.37. Users should upgrade to these versions or later to remediate this vulnerability. Patch status is not explicitly stated beyond the version fix; therefore, verify with the vendor advisory for the latest remediation guidance.