2026-04-08 · 2026-Q2
PraisonAI Template Injection in Agent Tool Definitions
PrimaryL5ConfigSecondaryL2Instruction
- Fixable:
- Yes, vendor patch
- Vendor response:
- Patched
- In the wild:
- No
- Actor:
- Attacker
Target
PraisonAI (multi-agent teams framework, PyPI) prior to v4.5.115
Impact
Arbitrary code execution via template expressions injected into agent.start() input processed by create_agent_centric_tools()
Root Cause
Unescaped user input passed directly to template-rendering tools such as acp_create_file