PraisonAI’s MCP command parser contains a flaw because it neither enforces a command allowlist nor validates arguments before executing them via subprocess. This omission lets an attacker supply arbitrary executable names and inline code‑execution flags such as bash, python, or /bin/sh, causing those commands to run on the host. The result is full compromise of the affected system, allowing execution of malicious code and potential disclosure, modification, or destruction of data, and service disruption.

MervinPraison PraisonAI implementations whose versions precede 4.6.9 are affected. Any deployment of this multi‑agent team system running an unpatched build is vulnerable and should be considered at risk.

The vulnerability carries a CVSS score of 9.8, indicating critical severity. While EPSS data is not available and the issue is not listed in CISA KEV, the flaw permits straightforward exploitation once an attacker can reach the MCP command interface. Based on the description, it is inferred that the likely attack vector is network access to the MCP command interface, or local access by privileged users. If that interface is exposed to the network or accessible by privileged users, the risk is high and the attacker can easily trigger arbitrary code execution.