PraisonAIAgents is a multi‑agent system used for orchestrating AI workloads. In releases before version 1.5.128 the execute_command routine in shell_tools.py applies os.path.expandvars() to every supplied argument even though shell=False is used. This unintended expansion allows an attacker to have environment variables such as database passwords, API keys, or cloud access tokens inserted into the command that actually runs, while the approval interface continues to display the original unexpanded $VAR syntax. The consequence is that privileged secrets can be leaked out of the system without the end‑user’s awareness, creating a deceptive approval process and a potential exposure of credential data.

The vulnerability affects instances of PraisonAIAgents published by MervinPraison, specifically all versions earlier than 1.5.128. Version 1.5.128 and later incorporate a fix that removes the manual variable expansion step.

The issue carries a CVSS base score of 7.4, indicating moderate‑to‑high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must be able to influence command arguments or set environment variables on the host; thus the exposure is likely limited to privileged or local users. Nonetheless, the privacy impact of secret exfiltration makes the problem significant, especially in environments where sensitive credentials are stored in environment variables.