PraisonAI’s workflow engine processes YAML files with type: job that can contain run, script, or python elements. These steps invoke shell commands or inline Python without validation, allowing an attacker to execute arbitrary code on the host system. The vulnerability is identified as CWE-78 and CWE-94, representing OS command injection and code injection. The impact is full remote code execution resulting in complete compromise of the machine and any data or credentials the system can access.

The affected products are MervinPraison PraisonAI and its agent component praisonaiagents. Versions prior to 4.5.139 of PraisonAI and 1.5.140 of praisonaiagents are vulnerable. The issue was fixed in those specific version thresholds, which are listed as the minimum safe release numbers.

The CVSS base score of 9.8 reflects critical risk. EPSS data is not available, and it is not listed in the CISA KEV catalog. The likely attack vector is an attacker that can provide or modify a workflow YAML file, which, based on the description, is inferred to occur through CI pipelines, shared code repositories, or multi‑tenant deployment environments. Successful exploitation yields full arbitrary command execution on the host, granting the attacker control over the system and access to all data it can reach.