PraisonAI's workflow "include" feature in versions 3.9.26 through 4.6.57 and praisonaiagents 0.12.12 through 1.6.57 is vulnerable to arbitrary code execution due to improper control of code generation (CWE-94). The method Workflow._execute_include() imports and executes an included recipe's tools.py file using importlib.util.spec_from_file_location() and spec.loader.exec_module() without enforcing the PRAISONAI_ALLOW_TEMPLATE_TOOLS or PRAISONAI_ALLOW_LOCAL_TOOLS opt-in gates or routing through the centralized safe loader. This allows an attacker who can cause a victim process to run a workflow including an attacker-controlled local recipe directory to execute arbitrary Python code as the PraisonAI process user. This vulnerability bypasses previous hardening measures related to automatic tools.py RCE. The vulnerability is addressed in praisonai version 4.6.58 and praisonaiagents version 1.6.58.

Successful exploitation allows arbitrary Python code execution with the privileges of the PraisonAI process user. This can lead to full compromise of the affected system, including confidentiality, integrity, and availability impacts. The vulnerability bypasses existing hardening mechanisms, increasing the risk of exploitation. However, exploitation requires the attacker to cause a victim to run a workflow or recipe that includes an untrusted local recipe directory.

A fix is available in praisonai version 4.6.58 and praisonaiagents version 1.6.58. Users should upgrade to these versions or later to remediate this vulnerability. No other mitigation guidance is provided or required beyond applying the official fix.