PraisonAI, a multi‑agent framework, contains a flaw in its Python API where hidden metadata in a web page can be exploited to write attacker‑controlled content to any filesystem path. The write_file function bypasses path validation when the optional workspace argument is None, a value that is always None in production environments. As a result, an attacker who can influence the hidden metadata can create, modify, or delete files across the system, enabling potential code execution, data tampering, or privilege escalation.

All deployments of PraisonAI from MervinPraison with versions older than 4.6.40 are affected. The issue manifests when the default configuration is used, causing the workspace to default to None. Version 4.6.40 and subsequent releases contain the fix that restores proper path validation.

The flaw has a CVSS score of 7.1, indicating moderate to high severity. The EPSS score is below 1 %, suggesting a low likelihood of exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to manipulate hidden metadata of a loaded webpage, which can be achieved through social engineering or compromised content. Successful exploitation would allow arbitrary file writes, effectively compromising system integrity and potentially enabling further attacks.