2026-04-08 · 2026-Q2
PraisonAI Template Injection in Agent Tool Definitions
Who wrote the file that runs on open?
- Fixable
- Vendor patch
- Vendor response
- Patched
- In the wild
- No
- Actor
- Attacker
Target
PraisonAI (multi-agent teams framework, PyPI) prior to v4.5.115
Impact
Arbitrary code execution via template expressions injected into agent.start() input processed by create_agent_centric_tools()
Root cause
Unescaped user input passed directly to template-rendering tools such as acp_create_file
CVE
Sources
Catalog
Cite this: AgentProv incident record: PraisonAI Template Injection in Agent Tool Definitions (2026-04-08). https://agentprov.com/incidents/2026-04-08-praisonai-template-injection-in-agent-tool-definitions
Related
- Also L5 · 2026-10-25Planted AGENTS.md in a Downloads Folder Got Codex to Install Malware; a CLAUDE.md Variant Exposed Claude Code's OAuth TokenL5Config
- Also L5 · 2026-10-21MCP Inspector Advisory Batch: Two Critical Paths From Connecting to a Malicious MCP Server to Local Command ExecutionL5Config
- Also L5 · 2026-10-16Claude Agent SDK: A Crafted Session ID Injects an MCP Server and Runs Commands Past SDK Permissions (CVE-2026-96620)L5Config