Executive brief
PraisonAI is an AI framework used to deploy autonomous agents to cloud environments. A vulnerability in its deployment script allows an attacker who can influence local configuration or environment variables to inject unauthorized settings into the production cloud service. This could lead to the theft of sensitive API keys, redirection of AI traffic to malicious servers, or full compromise of the deployed application's environment.
Technical details
The `deploy.py` script in PraisonAI performs improper neutralization of argument delimiters (CWE-88) when constructing commands for the `gcloud` CLI. Specifically, it interpolates `openai_model`, `openai_key`, and `openai_base` into a single comma-delimited string for the `--set-env-vars` flag. Because `gcloud` uses commas as internal delimiters for this flag, an attacker can include a comma in any of these values to inject additional `KEY=VALUE` pairs. This allows for environment variable injection or overriding existing variables like `OPENAI_API_KEY`. The vulnerability is exploitable if an attacker can modify local environment variables, `.env` files, or CI/CD secrets used during the deployment process. The issue is fixed in version 4.5.128 by using separate `--update-env-vars` flags for each variable.
Affected products
- MervinPraison PraisonAI < 4.5.128
Timeline
- 2026-04-09: advisory: GitHub Advisory GHSA-fvxx-ggmx-3cjg published
- 2026-04-10: patched: Fix released in version 4.5.128