PraisonAI exposes an execute_command function and shell execution within workflows to user-controlled input. Attackers can inject shell metacharacters through agent workflows, YAML definitions, or LLM-generated tool calls, allowing arbitrary shell commands to run. This elevates the vulnerability to full remote code execution, compromising confidentiality, integrity, and availability of affected systems.

The vulnerability affects MervinPraison PraisonAI installations running any version prior to 4.5.121. Users who can define or modify agent workflows, upload YAML definitions, or trigger LLM-generated tool calls are at risk.

With a CVSS score of 9.7 the flaw is considered critical. While EPSS data is not available, the combination of high severity and the ability to inject commands directly from user-controlled inputs suggests a high likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, but the remote attack vector and explicit command execution capabilities warrant immediate attention. Exploitation requires only the ability to supply or alter workflow definitions, which many users may have if role-based controls are not enforced.