PraisonAI contains a vulnerability that allows unauthenticated remote code execution. An unguarded import sink in praisonai/templates/tool_override.py is reached by the recipe runner on every recipe execution, and an attacker can drop a crafted tools.py next to a recipe's TEMPLATE.yaml. When the server exec_module()s the file via a POST request to /v1/recipes/run the attacker’s code runs with the server’s privileges. No authentication is required and the flaw can be triggered using either a local absolute path or an unrestricted GitHub repository path.

Affected are installations of MervinPraison’s PraisonAI from version 4.5.139 up to, but not including, 4.6.32.

The CVSS score of 8.4 indicates a severe impact. The EPSS value is not available and the vulnerability is not listed in CISA KEV, so there is no indication of known exploits yet. However, the lack of authentication and the ability to execute arbitrary code via a simple HTTP call make exploitation highly feasible. Until the patch to 4.6.32 is applied, the risk remains high for any exposed PraisonAI instance.