PraisonAI automatically loads and executes a file named tools.py from the current working directory during startup. The loader uses importlib.util.spec_from_file_location and runs module‑level code without any user consent, validation, or sandboxing. Because the file is loaded implicitly and even if it is not referenced in configuration files, placing a malicious tools.py in the working directory is sufficient to trigger code execution. This behavior breaks the expected security boundary between user‑controlled project files and executable code.

The vulnerability applies to MervinPraison’s PraisonAI product in all releases prior to version 4.5.128. Users running any older version are exposed when a tools.py file exists in the directory where PraisonAI is executed.

The CVSS score of 7.8 indicates high severity. No EPSS score is reported, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to place a tools.py file in the working directory, such as through compromised write permissions or insecure CI/CD configurations. The combination of a high CVSS rating and the potential for automated code execution makes this a notable risk that demands timely remediation.