Executive brief
PraisonAI is an AI agent framework used to build and deploy automated AI workflows. A security flaw in its deployment tool allows a malicious project configuration to execute unauthorized code on a user's system. If a user attempts to deploy an API server using a compromised configuration file, an attacker could gain full control over the server, leading to data theft or persistent access to the environment.
Technical details
A code injection vulnerability (CWE-94) exists in the `generate_api_server_code` function within `src/praisonai/praisonai/deploy/api.py`. The generator uses f-strings to interpolate configuration values like `deploy.api.host` and `agents_file` directly into Python source code without escaping or sanitization. An attacker can craft a malicious `agents.yaml` file containing Python expressions that "break out" of the string literals in the generated script. These expressions execute either when the generated server starts (via the host parameter) or when specific API routes are handled (via the agents_file parameter). Exploitation requires a user to run the deployment flow on a malicious configuration file. The issue is fixed in version 4.6.78.
Affected products
- MervinPraison PraisonAI < 4.6.78
Timeline
- 2026-06-25: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: CVE-2026-61433 published to NVD