The vulnerability allows an unauthenticated or incorrectly authenticated requester to invoke the AgentOS chat endpoint, which immediately passes the received message to the deployed agent without any access control. Because AgentOS can be configured with private context, memory, and API integrations, an attacker can trigger arbitrary agent actions that may read sensitive data, manipulate internal state, or invoke paid model calls. This flaw exceeds simple data leakage and effectively enables remote execution of agent code with the permissions of the Service.

MervinPraison PraisonAI, versions 4.2.1 through 4.6.58 inclusive, and all releases that were built after the GHSA‑pm96 patched release but did not incorporate the 4.6.59 fix, are vulnerable. The patch was released in version 4.6.59.

The CVSS score of 9.8 indicates a critical severity. The EPSS is not available, but the lack of a KEV listing does not mitigate the risk. Attackers can exploit the flaw by sending simple HTTP requests to the chat endpoint over the network; no special privilege or additional authentication is required. The agent runs in the context of the running service, so any sensitive data held or any cost‑bearing API calls can be triggered by a remote actor.