PraisonAI versions before 1.5.128 expose a cross‑origin agent execution flaw. The AGUI endpoint does not require authentication and unconditionally sends an Access‑Control‑Allow‑Origin: * header. Combined with Starlette’s lenient JSON parsing, an attacker can send a POST request to /agui, bypass CORS policy checks, and cause the server to execute arbitrary agent commands, yielding the results of those commands and sensitive environment information. The weakness maps to CWE‑942, reflecting a lack of proper authentication control for remote code execution.

The vulnerability affects PraisonAI by the vendor PraisonAI, specifically all releases before version 1.5.128. Hosts running these affected versions, regardless of platform, are susceptible unless mitigated.

The CVSS score of 8.6 indicates high severity, and while an EPSS score is not reported, the absence of a KEV listing does not reduce the risk because the flaw allows remote attackers to trigger arbitrary code execution without authentication. The attack can be performed by any external party over the network, requiring only the ability to send crafted HTTP POST requests to the AGUI endpoint. An attacker could therefore gain full control over the agent service, potentially leading to larger system compromise.