PraisonAIAgents allows user–supplied strings to be passed directly to the operating system shell through subprocess.run() with shell=True, and it performs no sanitization. This design flaw enables shell metacharacter injection, giving an adversary the ability to execute arbitrary commands. Two distinct exposure paths exist: configuration hooks registered via pre_run_command and post_run_command events, and the lifecycle configuration file ".praisonai/hooks.json". The latter is particularly dangerous because an attacker who can write to this file—such as by exploiting a prompt injection that grants file‑write access—can overwrite the configuration and have their malicious payload run silently at every lifecycle event without further interaction.

The vulnerability affects the MervinPraison PraisonAIAgents product prior to version 1.5.128. All releases before 1.5.128 contain the insecure memory hooks executor and are susceptible to command injection. Version 1.5.128 and later have the fix applied.

The flaw is rated with a CVSS score of 9.3, indicating critical severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, suggesting that exploitation may not yet be widespread, though the potential impact remains high. Attacking the flaw requires the ability to supply a crafted command string or to overwrite the hooks.json file, which can be achieved via prompt injection or local write access. Once exploited, the attacker gains the same privileges as the PraisonAIAgents process, allowing full control over the host system.