PraisonAI versions prior to 4.6.78 contain a code injection flaw in deploy/api.py. The agents_file parameter is directly interpolated into an f-string without any sanitization, and the resulting string is executed via subprocess.Popen(). This allows an attacker to inject arbitrary Python code that runs with the privileges of the server process. The weakness is classified as CWE‑94, which describes code injection vulnerabilities.

The affected products are PraisonAI from MervinPraison. All releases earlier than version 4.6.78 are vulnerable. The software is generally used for deploying AI agents through an API endpoint.

The vulnerability has a CVSS score of 9.4, indicating a critical risk level. The EPSS score is < 1%, indicating a very low but non‑zero probability of exploitation, while the lack of a KEV listing does not negate the high severity. The typical attack path is likely through the public or remote API that accepts the agents_file parameter, enabling arbitrary code execution when an attacker crafts a malicious value. Successful exploitation would give the attacker full control of the host executing the server code.