CVE-2026-47398

Description

PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334

Overview

State

—

Assigner (CNA)

—

CVSS severity

high

CVSS score

8.1 / 10

CVSS vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Effective score

8.1 / 10 HIGH source: CNA overview

CWE(s)

—

Reserved

—

Published

—

Last updated

—

Source

https://www.tenable.com/cve/CVE-2026-47398

Linked Threat

CVE-2026-47398 — CVE-2026-47398

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2026-46306

Assigner

GitHub_M

Published

Jul 21, 2026, 4:01:22 PM

Updated

Jul 21, 2026, 4:33:53 PM

EUVD base score (CVSS 3.1)

8.1 / 10
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EUVD-reported EPSS

0.3300

Vendors

mervinpraison

Products

PraisonAI (< 4.6.40)

Aliases

GHSA-78r8-wwqv-r299, PYSEC-2026-2905

ENISA description: PraisonAI is a multi-agent teams system. The v4.6.32 chokepoint refactor (which patched CVE-2026-44334 / GHSA-xcmw-grxf-wjhj) added the PRAISONAI_ALLOW_LOCAL_TOOLS env-var gate to the tool_override.py sinks. However, two additional spec.loader.exec_module call sites in praisonai/agents_generator.py were missed and remain completely unguarded in versions prior to 4.6.40. Both functions accept a module_path parameter sourced from YAML configuration and execute it without validation, signature checking, or the env-var gate. Version 4.6.40 fixes the issue.

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (2)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• https://nvd.nist.gov/vuln/detail/CVE-2026-47398 tenable:nvd.nist.gov
• https://www.cve.org/CVERecord?id=CVE-2026-47398 tenable:www.cve.org

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

• Microsoft Patch Tuesday for June 2026 — Snort rules and prominent ...
  web:blog.talosintelligence.com

  Microsoft Patch Tuesday details for June 2026 . Microsoft has released its monthly security update for June 2026 , which includes 206 vulnerabilities affecting a range of products, including 32 that Microsoft marked as "critical". Out of 32 "critical" entries, 28 are remote code execution (RCE) vulnerabilities in Microsoft Windows services and applications including Windows Active Directory ...

  2026-06-19 02:30 UTC
• Microsoft Patch Tuesday May 2026 - 120 Vulnerabilities Fixed, Including ...
  web:cybersecuritynews.com

  Microsoft's May 2026 Patch Tuesday lands with a heavy enterprise focus, fixing 120 vulnerabilities across Windows, Office, Azure, developer tools, and Microsoft 365 apps, including 29 remote code execution (RCE) flaws rated Critical.

  2026-06-19 02:30 UTC
• Nvd - Cve-2026-47298
  web:nvd.nist.gov

  NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

  2026-06-19 02:30 UTC
• Security Update Guide - Loading - Microsoft
  web:portal.msrc.microsoft.com

  The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

  2026-06-19 02:30 UTC
• Description of the security update for SharePoint Server Subscription ...
  web:support.microsoft.com

  Improvements and fixes This security update introduces the SharePoint Server Subscription Edition Version 26H1 feature update. This feature update will be included in all SharePoint Server Subscription Edition public updates going forward. For more information about this feature update, see New and improved features in SharePoint Server Subscription Edition Version 26H1. This link may be ...

  2026-06-19 02:30 UTC
• SAP Security Patch Day - February 2026
  web:support.sap.com

  SAP security Patch Day Bulletin This post shares the information on security notes that remediate vulnerabilities discovered in SAP products. SAP strongly recommends that the customer visits the Support Portal and applies patches on priority to protect their SAP landscape. On 10th of February 2026 , SAP security patch day saw the release of 26 new security notes. Further, there was 1 update to ...

  2026-06-19 02:30 UTC
• CVE-2026-47298 - vulnerability database | Vulners.com
  web:vulners.com

  CVE - 2026 -47298 constrains Microsoft Office SharePoint, where improper authorization allows an attacker with network access to execute code on vulnerable systems. The vulnerability is described as a remote code execution issue with a high impact on...

  2026-06-19 02:30 UTC
• Oracle Critical Security Patch Update Advisory - May 2026
  web:www.oracle.com

  Prior Critical Patch Update and Critical Security Patch Update advisories should be reviewed for information regarding earlier published security patches. Refer to Critical Patch Updates, Critical Security Patch Updates, Security Alerts and Bulletins for information about Oracle Security advisories.

  2026-06-19 02:30 UTC
• Patch Tuesday - June 2026 - Rapid7
  web:www.rapid7.com

  Microsoft is publishing 200 vulnerabilities on June 2026 Patch Tuesday, including an HTTP/2 denial of service vulnerability and an elevation of privilege vulnerability in PowerToys.

  2026-06-19 02:30 UTC
• Patch Tuesday June 2026: Security Updates & CVE Analysis
  web:zecurit.com

  Get the complete breakdown of Microsoft's June 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

  2026-06-19 02:30 UTC

Only Available for Registered Users. Sign in to view.