CVE-2026-44339 - Vulnerability Analysis

Overview

PraisonAI < 4.6.37 and praisonaiagents < 1.6.37 contain an unauthorized function invocation vulnerability caused by resolving unresolved tool names against module globals and __main__, letting attackers invoke unintended application callables, exploit requires attacker to influence tool-call names.

Severity & Score

Impact

Attackers can invoke unintended application functions, potentially leading to unauthorized actions or code execution.

Mitigation

Update to praisonai version 4.6.37 and praisonaiagents version 1.6.37 or later.

References

• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-gmjg-hv98-qggq

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner