PraisonAI before version 4.5.128 constructs a gcloud run deploy command by concatenating three inputs—openai_model, openai_key, and openai_base—into a single comma‑delimited string. Because the command does not validate that these values lack commas, any comma in one of the values causes gcloud to split the string and treat the trailing text as additional key=value pairs. This results in arbitrary environment variables being injected into the deployed Cloud Run service, potentially allowing an attacker to manipulate configuration or execute malicious code, which is a remote code execution vulnerability.

The flaw affects deployments of PraisonAI managed by MervinPraison that use the deploy.py script in versions earlier than 4.5.128. No other vendors or products are listed as affected.

The CVSS score of 8.4 indicates high severity. Exploitation requires the ability to supply openai_model, openai_key, or openai_base during deployment, and the vulnerability is not included in CISA's Known Exploited Vulnerabilities catalog. The attack vector is the deployment phase and depends on unsanitized input to gcloud; no publicly documented exploits are cited in the CVE data. EPSS information is unavailable.