PraisonAI, distributed as the pip package praisonaiagents, contains an unsafe dynamic module loading vulnerability in the component AgentFlow._resolve_pydantic_class. When a workflow step references a string output_pydantic, the framework unconditionally loads and executes a sibling tools.py file from the workflow directory using importlib.exec_module without any sandboxing, ignoring the PRAISONAI_ALLOW_*_TOOLS environment variables. This flaw allows an attacker who can control both the workflow file and the associated tools.py to run arbitrary Python code with the same privileges as the WorkflowManager, effectively granting remote code execution. The weakness corresponds to CWE‑693, exposing the system to unauthorized control flow injection.

The vulnerability affects all installations of PraisonAI provided by vendor MervinPraison, specifically the praisonaiagents package version prior to 1.6.78. No other products or vendors are listed as affected.

The CVSS score of 8.5 reflects a high severity risk, and with an EPSS score of less than 1% the exploitation probability is very low. There is no KEV listing, indicating no known widespread exploitation yet. The likely attack vector requires an attacker to place malicious code in a workflow file and its sibling tools.py within the same directory, a scenario enabled when the workflow runner has write access or a user with sufficient privilege can supply the files. Once the workflow is executed via WorkflowManager or load_yaml, the attacker’s code runs with the process’s privileges, potentially compromising the entire host system.