The vulnerability arises from an unauthenticated A2A JSON‑RPC endpoint exposed by PraisonAI’s first‑party A2A server example, combined with a tool that uses Python eval. An unauthenticated attacker can POST a JSON‑RPC request to the /a2a endpoint on any address the server binds to (0.0.0.0). The request is routed to agent.chat(), causing an LLM client to invoke the registered calculate tool; the tool’s eval executes the supplied expression in the server’s Python process. This allows the attacker to run arbitrary code with the privileges of the server process, enabling full compromise of confidentiality, integrity, and availability. The same example also exposes task history and task‑cancellation APIs, further increasing the confidentiality and integrity impact. PraisonAI version 4.6.40 removes the unauthenticated endpoint and the unsafe eval implementation, fixing the vulnerability.

On the PraisonAI platform by MervinPraison, every deployment using the first‑party A2A server example before version 4.6.40 is vulnerable. This includes the public default example that binds to 0.0.0.0 and registers the calculate tool, as well as any private deployments that copy that configuration. Versions 4.6.40 and later contain the patch; any system that has upgraded to 4.6.40 or later is safe provided it follows the new configuration guidelines.

The CVSS score of 9.8 indicates critical severity, but the EPSS score of less than 1 % indicates an extremely low probability that an exploit has been observed in the wild at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog, suggesting there are no known mass‑distributed exploits. The most likely attack vector, inferred from the description, is a remote unauthenticated HTTP request to the open /a2a endpoint, which any LLM capable of interpreting the calculate tool can trigger. Because the server listens on 0.0.0.0, the attack can be performed from any network that can reach the host, and does not require privileged credentials.