PraisonAI versions prior to 4.6.78 construct Python source code for API servers without properly escaping configuration values. The deploy.api.host and agents_file fields can contain arbitrary Python expressions, which are executed when the generated server starts or processes requests. This vulnerability, classified as CWE‑94, enables an attacker to run malicious code with the same privileges as the server, compromising confidentiality, integrity, and availability of the deployed application.

The vulnerability affects the PraisonAI product developed by MervinPraison, specifically releases before 4.6.78. Any deployment that relies on the API deployment generator and exposes the deploy.api.host or agents_file configuration parameters is susceptible.

The CVSS score of 8.5 indicates a high severity, while the EPSS score of less than 1% suggests a low current exploitation probability but still a recognized risk. Because the weakness permits code injection through configuration, the attack vector is likely remote, leveraging the API or deployment pipeline to inject malicious values. The vulnerability is not listed in CISA's KEV catalog, but it remains a serious risk for organizations running susceptible versions.