PraisonAI’s compute bridging subsystem uses raw file path arguments to build shell command strings that are passed to compute providers. An attacker who can control a file-tool path argument can break out of the intended path quoting and inject arbitrary shell commands into the compute environment. The vulnerability can lead to unrestricted command execution on the host when compute="local" or inside a Docker container when using a containerized provider.

The flaw affects MervinPraison PraisonAI versions from 4.6.10 through 4.6.58. These releases use a LocalManagedAgent or SandboxedAgent that perform file operations via compute bridging, exposing the intake of unvalidated file paths to shell execution. Users of affected versions suffer the risk until they update to 4.6.59 or later, which removes the vulnerable behavior.

With a CVSS score of 8.8 the vulnerability is considered high severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation yet. However, exploitation requires control over a file-tool path argument, which may be feasible if local users or compromised agents can supply that input. The attack path can execute arbitrary commands on the host system or within containers, resulting in full system compromise if attackers gain elevated compute privileges.