Executive brief
PraisonAI is a framework used to build and manage teams of AI agents. A security flaw in how the system handles agent instructions allows an attacker to execute malicious commands on the underlying server. This could lead to a total system takeover, unauthorized access to sensitive data, or the deployment of ransomware.
Technical details
A Server-Side Template Injection (SSTI) vulnerability exists in PraisonAI's agent tool definitions. The `create_agent_centric_tools()` function generates tools, such as `acp_create_file`, that utilize template rendering for file content without proper input sanitization. An attacker with the ability to provide input to `agent.start()` can inject malicious template expressions (e.g., Jinja2 syntax) to achieve arbitrary code execution. The risk is exacerbated by the ACP-enabled runtime's "auto" approval mode, which allows these operations to proceed without manual intervention. The vulnerability is addressed in version 4.5.115 by implementing better input handling.
Affected products
- MervinPraison PraisonAI < 4.5.115
Timeline
- 2026-04-07: advisory: GitHub advisory published by maintainer
- 2026-04-08: disclosed: CVE-2026-39891 published
- 2026-04-08: patched: Fix released in version 4.5.115