PraisonAI before version 4.6.78 allows attackers to craft malicious YAML workflow files that include “import os” followed by “os.system()” calls. The JobWorkflowExecutor._exec_inline_python() method does not fully validate the abstract syntax tree, enabling bypass of the sandbox and execution of arbitrary OS commands with the privileges of the executing process. This flaw is a classic command injection condition (CWE-78) that can compromise confidentiality, integrity, and availability of the host system.

Affected are installations of PraisonAI from the vendor MervinPraison running any version older than 4.6.78. The vulnerability is tied to the JobWorkflowExecutor component and can be triggered by any user able to upload or otherwise submit workflow YAML files to the system.

The CVSS score of 7 indicates a high severity, and the EPSS score of < 1% suggests that exploitation is unlikely but not impossible. The issue is currently not listed in the CISA KEV catalog. The likely attack vector involves remote deployment or submission of a crafted workflow file; once processed, the untrusted script runs with the system’s process privileges, enabling full remote code execution. No additional prerequisites beyond the ability to provide a workflow file are specified, making the vulnerability exploitable by anyone with write access to that deployment mechanism.