PraisonAI, a multi‑agent teams system, has an OS command injection flaw. Between versions 4.5.15 and 4.5.68, the --mcp command‑line argument is passed directly through shlex.split() and forwarded to anyio.open_process() without any validation. This enables an attacker who can supply a command line to execute arbitrary operating‑system commands with the privileges of the process user, potentially compromising the entire system.

The affected vendor is MervinPraison and the product is PraisonAI. All releases from 4.5.15 up to, but not including, 4.5.69 are vulnerable. The issue was fixed in release 4.5.69; later versions are not affected.

The vulnerability carries a CVSS score of 9.8, indicating critical severity. The EPSS score is below one percent, suggesting a low probability of exploitation in the near term, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector, as inferred from the description, is local: an attacker must be able to run the vulnerable CLI command. Successful exploitation would allow execution of arbitrary shell commands and could lead to full system compromise.