PraisonAI processes template files that it retrieves from remote URLs, treating them as trusted executable code without verifying their integrity, validating their source, or seeking user consent. Because of this lack of validation, an attacker can supply a malicious template that the system will execute, providing remote code execution with full control over the application and its underlying environment. This vulnerability is classified as CWE‑829, representing untrusted code execution stemming from insecure handling of external artifacts.

The flaw affects all installations of PraisonAI running a version earlier than 4.5.128. The only vendor identified is MervinPraison, whose PraisonAI product implements the vulnerable template processing logic. Versions 4.5.128 and later include the necessary safeguards to prevent execution of unverified remote templates.

The CVSS score of 9.3 signals a severe risk, indicating that an attacker that can influence the remote location of a template can run arbitrary code on the target system. Exploitation requires no authentication and no user interaction, as the system automatically fetches and executes the template during normal operation. EPSS data is not provided, and the vulnerability is not yet listed in the CISA Known Exploited Vulnerabilities catalog, though its high severity suggests that it could be a target for future supply‑chain attacks.