PraisonAI allows an attacker who can influence agent tool‑call names to execute undeclared callables within the application. The flaw originates from the ToolExecutionMixin resolving unknown tool names against module globals and the __main__ namespace when the declared list and registry do not contain the requested name. Because the default permission gate variable _perm_allow is None, these non‑dangerous tool names bypass authorization checks, permitting execution of code that was never intended to be exposed as a tool. The attacker can run arbitrary functions defined in the application.

Affected systems include PraisonAI multi‑agent teams delivered by MervinPraison. The vulnerability affects all releases prior to PraisonAI 4.6.37 and PraisonAIAgents 1.6.37; newer releases contain the fix.

The CVSS score of 8.6 indicates high severity. EPSS data is not available, so precise exploitation probability cannot be quantified, and the issue is not listed in CISA’s KEV catalog. The likely attack vector is through crafted agent messages or inputs that specify tool names not present in the declared tool list, thereby reaching the underlying resolution logic. Once triggered, the agent can execute arbitrary callables in the same process with the privileges of the agent, effectively enabling uncontrolled code execution.