The vulnerability allows an attacker who can write a file to the directory where PraisonAI is launched to place a malicious tools.py file. PraisonAI imports this file automatically at startup without validation, sandboxing, or user confirmation, enabling the execution of arbitrary Python code. This leads to full compromise of the PraisonAI process, the host system, and any stored credentials or data. The weakness maps to CWE-426 (Untrusted Search Path) and CWE-94 (Code Injection).

The affected products are MervinPraison PraisonAI and MervinPraison praionaiagents. Versions 4.5.138 and earlier are vulnerable; the issue was fixed in version 4.5.139.

The CVSS score of 8.4 indicates a high severity. Although an EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the exploitation risk remains significant in environments where an attacker can write to the application’s launch directory—such as shared workspaces, cloned repositories, or writable build environments. Successful exploitation results in immediate arbitrary code execution with full permissions of the host process.