PraisonAI workflow "include" allows attacker‑controlled local recipes to cause arbitrary Python code execution during include setup. The flaw originates from the Workflow._execute_include() function, which uses importlib.util.spec_from_file_location() to import a tools.py script without checking the PRAISONAI_ALLOW_TEMPLATE_TOOLS/PRAISONAI_ALLOW_LOCAL_TOOLS gates or routing through the secure loader. Because of this, a workflow that includes an untrusted local recipe directory runs that recipe's tools.py module before any child workflow parsing or model call, giving an attacker the ability to execute module‑level code as the PraisonAI process user.

Vulnerable versions are PraisonAI 3.9.26 through 4.6.57 and praisonaiagents 0.12.12 through 1.6.57. The fix is available in PraisonAI 4.6.58 and praisonaiagents 1.6.58.

The CVSS score is 7.8, indicating high severity. EPSS is not available, so the exploitation probability is unknown, and the vulnerability is not listed in the KEV catalog. Attackers who can influence workflow inclusion—such as through user‑supplied recipes or unmanaged internal workflows—can trigger the flaw. The vulnerability bypasses the hardening that protected earlier tools.py RCE issues, so the exploit path is straightforward: supply a crafted local recipe whose tools.py contains malicious code, trigger a workflow that includes it, and the code runs with process privileges.