CyberRota Analysis
AI-GeneratedPraisonAI versions prior to 4.6.40 are vulnerable due to an unauthenticated A2A JSON-RPC endpoint that allows remote attackers to execute arbitrary Python code using the `calculate(expression)` tool, which leverages Python's `eval()` function. This critical vulnerability can lead to unauthorized access to sensitive task history and the ability to manipulate ongoing tasks, significantly compromising the confidentiality and integrity of the system. Organizations utilizing PraisonAI, especially those deploying the official A2A example or similar configurations, should prioritize upgrading to version 4.6.40 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's first-party A2A server example exposes an unauthenticated A2A JSON-RPC endpoint and registers a `calculate(expression)` tool implemented with Python `eval()`. The example also binds to `0.0.0.0`. A remote unauthenticated attacker can send `message/send` to `/a2a`; the request reaches `agent.chat()`, and a real LLM can invoke the registered `calculate` tool. In testing with `gemini/gemini-2.5-flash-lite`, this resulted in arbitrary Python execution in the server process, confirmed by creation of a marker file from an unauthenticated HTTP request. The issue affects deployments following the official A2A example or similar unauthenticated public A2A deployments with unsafe tools. The default unauthenticated A2A surface also exposes task history and task cancellation APIs, increasing confidentiality and integrity impact. Version 4.6.40 patches the issue.