PraisonAI's run_python() function constructs a shell command by directly interpolating potentially untrusted Python code into a string passed to subprocess.run with shell=True. The escape routine only handles backslashes and double quotes, leaving $() and backtick substitutions untouched. An attacker can inject these shell substitutions to trigger arbitrary operating system commands before Python even starts, thereby achieving complete code execution on the host where the agent runs. The vulnerability is scored CVSS 7.8, indicating a high impact on confidentiality, integrity, and availability.

The affected product is PraisonAI from MervinPraison. Any installation running a version earlier than 1.5.90 is vulnerable. The issue has been fixed by upgrading to version 1.5.90 or later.

Although the exploitation probability (EPSS) is less than 1% and the vulnerability is not listed in the CISA KEV catalog, the nature of the flaw—arbitrary command execution—makes it a serious threat. An attacker only needs to supply malicious code to run_python, which, if interpreted by the vulnerable agent, will run arbitrary OS commands. The risk is considerable, especially in environments where PraisonAI agents have elevated privileges or handle sensitive data.