PraisonAI’s agent tool definitions allow unescaped user input to be processed by a template rendering engine, which can execute embedded code. This flaw stems from the create_agent_centric_tools() function that returns tools such as acp_create_file, which treat template expressions as code rather than plain text. The result is that an attacker can inject arbitrary code through agent.start() and cause the system to run the supplied code, compromising confidentiality, integrity, and availability of the host environment.

The vulnerability affects all instances of MervinPraison PraisonAI below version 4.5.115. The affected product is the multi‑agent teams platform offered by MervinPraison, specifically any deployment that uses the legacy create_agent_centric_tools() API to build agent‑centric tools.

The CVSS score of 8.8 indicates high severity. No EPSS data is provided, so the exact probability of exploitation in the field is unknown. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending crafted input to agent.start() from an untrusted source; the lack of input sanitization allows template expressions to be interpreted and executed by the backend.