PraisonAI allows recipes to be defined by untrusted users. The system implements a dangerous‑tool policy that should only permit tools marked as dangerous when the recipe explicitly sets allow_dangerous_tools=True. In practice, the policy only checks tools listed in TEMPLATE.yaml requires.tools. The workflow parser, however, loads additional tool declarations from workflow.yaml and creates a separate approval context. An attacker can therefore declare a dangerous shell tool such as execute_command in workflow.yaml agents.*.tools and approve it via a top‑level approve: [execute_command] entry, bypassing the intended check. The recipe executes the shell tool, enabling arbitrary system commands with the privileges of the running PraisonAI process. The vulnerability is a classic command injection that impacts confidentiality, integrity, and availability. The vulnerability is enumerated as CWE‑78, CWE‑863 and CWE‑94.

The affected product is PraisonAI from MervinPraison. Versions from 4.5.87 up to, but not including, 4.6.61 are impacted. All earlier versions (<4.5.87) and the patched release 4.6.61 and later are considered safe for this specific issue.

The CVSS score of 7.8 classifies the vulnerability as high severity, indicating that an attacker who can supply a recipe would be able to run arbitrary commands. The EPSS score is not available, but the public advisory indicates that the flaw exists in a widely used open‑source system. The issue is not listed in the CISA KEV catalog, yet the lack of a patch until 4.6.61 suggests that malicious code could be deployed before users apply the fix. The likely attack vector is an untrusted recipe submitter that leverages the YAML workflow parser to subvert the dangerous‑tool policy, making exploitation feasible for anyone with write access to recipes. Given the high impact and the absence of a mitigation in earlier releases, the risk remains significant until the update is applied.