PraisonAI automatically loads a .praisonai/config.toml file from a repository folder and applies the defaults.output.output_file setting without validation. If that setting contains an absolute path or a '..' traversal sequence, when the developer calls agent.start() without explicitly passing an output parameter, PraisonAI writes the agent response to that location, creating parent directories as needed. The result is that an attacker who can influence the repository‑controlled config file can overwrite arbitrary files on the system with the privileges of the account running PraisonAI. This allows changes to configuration files, scripts, or other critical files that could lead to further compromise or denial of service.

All installations of the MervinPraison PraisonAI Python package (praisonaiagents) with pip versions earlier than 1.6.78 that load a .praisonai/config.toml inside a project root and run PraisonAI as a user with write permissions to the filesystem are susceptible.

The CVSS score of 6.9 indicates a moderate severity vulnerability, while the EPSS score is below 1% and it is not listed in the CISA KEV catalog, suggesting a low likelihood of widespread exploitation at present. However, the attack requires the ability to supply or modify a repository‑controlled config file, which can happen in environments that trust third‑party contributors. The vulnerability can lead to arbitrary file overwriting, potentially enabling the deployment of malicious scripts or the alteration of system configuration files if the attacker places an executable there.