CVE-2026-47391: PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution

Should you act?

Critical and remotely reachable

No known exploitation yet, but it is network-reachable without credentials. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• Not in CISA KEV, but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
• EPSS 1.2%, percentile 67: FIRST’s model estimates a 1.2% chance of exploitation activity in the next 30 days, higher than 67% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
• Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
• Only applies if your dependency tree includes PraisonAI (PyPI) <= 4.6.39, fixed in 4.6.40. Check your lockfile, including transitive dependencies.

What it is

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's first-party A2A server example exposes an unauthenticated A2A JSON-RPC endpoint and registers a calculate(expression) tool implemented with Python eval(). The example also binds to 0.0.0.0. A remote unauthenticated attacker can send message/send to /a2a; the request reaches agent.chat(), and a real LLM can invoke the registered calculate tool. In testing with gemini/gemini-2.5-flash-lite, this resulted in arbitrary Python execution in the server process, confirmed by creation of a marker file from an unauthenticated HTTP request. The issue affects deployments following the official A2A example or similar unauthenticated public A2A deployments with unsafe tools. The default unauthenticated A2A surface also exposes task history and task cancellation APIs, increasing confidentiality and integrity impact. Version 4.6.40 patches the issue.

From the GitHub advisory

Summary

The first-party PraisonAI A2A server example combines three behaviors into a remotely exploitable Critical chain:

1. The example exposes an A2A server without configuring authtoken. 2. The same example binds the server to 0.0.0.0. 3. The example registers a calculate(expression) tool implemented with Python eval(expression).

An unauthenticated network client can send a JSON-RPC message/send request to /a2a. The A2A handler passes the attacker-controlled message to agent.chat(). With a real Gemini LLM (gemini/gemini-2.5-flash-lite), the model invoked the registered calculate tool, causing the example's eval() call to execute Python in the server process. The canary wrote a marker file from an unauthenticated /a2a request.

This is not a claim that every A2A deployment is automatically RCE. The Critical chain is confirmed for the first-party A2A example, and for deployments that follow the same pattern: public unauthenticated A2A plus an unsafe tool such as this eval()-based calculate tool. The default unauthenticated A2A surface is the remote entry point; the official example's eval() tool provides the code execution sink.

Weakness type: CWE-95, CWE-306.

Product: PraisonAI (PyPI) · Assigned by: GitHub_M · Published: 2026-07-21

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: low
• Privileges required: none (no login)
• User interaction: none
• Scope: unchanged

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation poc, automatable yes, technical impact total.
• FIRST EPSS (model of 2026-10-21): 1.17% probability of exploitation activity in the next 30 days; percentile 67.

Timeline

• 2026-05-29 — GitHub-reviewed advisory GHSA-vg22-4gmj-prxw published (critical)
• 2026-07-21 — CVE record published by GitHub_M
• 2026-07-23 — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vulnerability records

1. GitHub Advisory GHSA-vg22-4gmj-prxw github.com
2. CVE.org record CVE-2026-47391 cve.org
3. NVD entry CVE-2026-47391 nvd.nist.gov

Other references from the CVE record and advisory

1. github.com github.com
2. github.com github.com
3. github.com github.com

Critical PyPI advisories · Today’s Security Digest