CVE-2026-47391 is an eval injection vulnerability in MervinPraison's PraisonAI affecting versions before 4.6.40. The first-party A2A server example binds to 0.0.0.0 and exposes an unauthenticated JSON-RPC endpoint that registers a 'calculate(expression)' tool implemented with Python's eval(). An attacker can remotely send a 'message/send' request to the /a2a endpoint, triggering the agent.chat() function, which invokes the vulnerable calculate tool. This leads to arbitrary Python code execution in the server process, confirmed by successful creation of files from unauthenticated HTTP requests. Additionally, the unauthenticated A2A interface exposes task history and cancellation APIs, increasing the confidentiality and integrity impact. The vulnerability is patched in version 4.6.40.

An unauthenticated remote attacker can achieve arbitrary code execution on the PraisonAI server process, compromising confidentiality, integrity, and availability. The exposure of task history and cancellation APIs without authentication further increases the risk of sensitive data disclosure and unauthorized task manipulation.

Upgrade PraisonAI to version 4.6.40 or later, where this vulnerability is patched. Avoid deploying the first-party A2A server example or similar configurations that expose unauthenticated JSON-RPC endpoints with unsafe tools such as those using Python eval(). Patch status is not explicitly stated in the vendor advisory, but version 4.6.40 is confirmed as fixed. No additional vendor advisory content is provided.