CVE-2026-61437 describes a protection mechanism failure in MervinPraison's PraisonAI (pip package praisonaiagents) prior to version 1.6.78. The vulnerability arises in the AgentFlow._resolve_pydantic_class method, which dynamically loads a sibling tools.py module from the workflow file's directory using importlib.exec_module without sandboxing or honoring PRAISONAI_ALLOW_*_TOOLS environment variables. This unsafe dynamic module loading enables an attacker who controls both the workflow file and its sibling tools.py to execute arbitrary Python code with the privileges of the workflow runner when the workflow is executed via WorkflowManager or after load_yaml.

An attacker with the ability to supply a malicious workflow file and a sibling tools.py can achieve arbitrary code execution with the workflow runner's privileges. This can lead to full compromise of the environment running PraisonAI workflows. The vulnerability requires local or limited access to supply workflow files but does not require prior privileges. The CVSS 4.0 score is 8.5 (high severity), reflecting the ease of exploitation and impact on confidentiality, integrity, and availability.

No official patch or remediation has been confirmed at this time. Users should upgrade to PraisonAI version 1.6.78 or later once available, as this version presumably addresses the vulnerability. Until a fix is released, avoid running untrusted workflow files or restrict the ability to supply arbitrary workflow files and sibling tools.py modules. Monitor vendor advisories for updates and apply official fixes promptly.