CVE-2026-61437: PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow

October 8, 2026

An unsafe dynamic module loading vulnerability allows an attacker who can control a workflow file and a sibling tools.py to execute arbitrary Python code when the workflow is executed.

References

github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4gfv-wg42-7jw5
github.com/advisories/GHSA-4gfv-wg42-7jw5
nvd.nist.gov/vuln/detail/CVE-2026-61437
www.vulncheck.com/advisories/praisonai-before-remote-code-execution-via-tools-py

Code Behaviors & Features

Detect and mitigate CVE-2026-61437 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →