The vulnerability resides in PraisonAI’s ast_grep_rewrite functionality, which lacks the @require_approval decorator used by successor mutation tools. When executed with dry_run=False and the --update-all option, an agent-controlled call can supply a broad path that rewrites all matching files without any authorization gate. This omission permits an insider or compromised agent to modify arbitrary files on the system, potentially leading to unauthorized configuration changes or code injection. The weakness is a missing authorization check, corresponding to CWE‑862.

Affected vendors and products are MervinPraison PraisonAI and the associated praisonaiagents component. Versions before praisonaiagents 1.6.58 are vulnerable. The corresponding PraisonAI software is referenced in release v4.6.58, which includes the security fix. Deployments using earlier builds of praisonaiagents should be identified and updated.

The CVSS score of 6.1 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that public exploitation may not be widespread yet. The likely exploitation path requires control over an agent to invoke the mutation tool with dry_run=False and a broad path, meaning the attack is limited to scenarios where an attacker can influence agent behavior. If achieved, the attacker can rewrite any file the agent is permitted to access, potentially compromising system integrity.