Executive brief
PraisonAI, an AI agent and workflow framework, is vulnerable to a critical security flaw that allows for remote code execution. By providing a specially crafted workflow file, an attacker can force the system to execute arbitrary commands or Python scripts on the host machine. This could lead to a total takeover of the server or development environment where the software is running.
Technical details
A remote code execution (RCE) vulnerability exists in PraisonAI due to the unsafe execution of commands defined in YAML workflow files. When a workflow with 'type: job' is processed, the JobWorkflowExecutor in 'job_workflow.py' uses subprocess.run() for 'run' keys, exec() for 'script' keys, and direct execution for 'python' keys without sufficient sanitization or sandboxing. An attacker can provide a malicious YAML file to achieve arbitrary command execution on the host. The vulnerability is addressed in PraisonAI version 4.5.139 and praisonaiagents version 1.5.140.
Affected products
- MervinPraison PraisonAI <= 4.5.138
- MervinPraison praisonaiagents <= 1.5.139
Timeline
- 2026-04-10: disclosed
- 2026-04-10: advisory
- 2026-04-10: patched: Fixed in PraisonAI 4.5.139 and praisonaiagents 1.5.140