PraisonAI stores agent output directly in the HTML returned by a Flask API endpoint without proper sanitization. The sanitizer relies on the nh3 library, which is not installed by default, making the sanitization step a no‑op. An attacker able to influence agent input—through techniques such as retrieval‑augmented generation data poisoning, web scraping results, or prompt injection—can embed arbitrary JavaScript into the output. When any user views the API response in a browser, the injected script runs with the privileges of that user, allowing actions such as session hijacking, credential theft, or malicious redirects. This is a classic stored cross‑site scripting weakness identified as CWE‑79.

The vulnerability affects the PraisonAI product developed by MervinPraison. All releases older than version 4.5.128 are impacted. The default installation of PraisonAI, which omits the nh3 dependency, exposes the flaw because the HTML sanitizer does nothing.

The CVSS score of 5.4 indicates moderate severity; the lack of an EPSS score and absence from the KEV catalogue suggest limited known exploitation, but the flaw could be leveraged in environments where API output is exposed to end users and the attacker can shape agent input. Exploitation requires only client‑side execution, so once the malicious content is delivered, the attack proceeds without additional privileges. The vulnerability is fixed in release 4.5.128, so updating to that or newer versions eliminates the risk.