PraisonAI versions before 4.6.40 include an unauthenticated A2A JSON-RPC endpoint bound to 0.0.0.0 that registers a 'calculate(expression)' tool implemented with Python eval(). An attacker can send unauthenticated requests to invoke this tool, resulting in arbitrary Python code execution in the server process. This was confirmed in testing with the gemini/gemini-2.5-flash-lite LLM by creating a marker file via an HTTP request. The default unauthenticated A2A interface also exposes task history and cancellation APIs, increasing the impact on confidentiality and integrity. The vulnerability is fixed in version 4.6.40.

An unauthenticated remote attacker can achieve arbitrary code execution on the PraisonAI server process, leading to full confidentiality, integrity, and availability compromise. The exposure of task history and cancellation APIs further increases the risk of sensitive information disclosure and unauthorized task manipulation.

Version 4.6.40 of PraisonAI patches this vulnerability. Users should upgrade to version 4.6.40 or later. Deployments following the official A2A example or similar unauthenticated public A2A configurations should be considered vulnerable until upgraded. No official temporary fixes or workarounds are documented; upgrading is the recommended remediation.