PraisonAI (praisonaiagents) prior to version 1.6.78 uses an insecure plugin manager that imports and executes arbitrary Python files located in project‑level and user‑home \.praisonai/plugins directories by calling importlib’s spec_from_file_location() and exec_module() without any code signing, integrity check, or sandbox isolation. An attacker who can write a malicious .py file to one of these plugin directories—through path traversal, a supply‑chain compromise, or by gaining write access—causes the application to load and run that code during startup, granting the attacker full control of the host system. This flaw is identified as CWE‑94. The vulnerability enables arbitrary code execution without needing elevated network privileges, making it a high‑impact risk.

The affected product is PraisonAI (praisonaiagents) from MervinPraison. All releases older than 1.6.78 are vulnerable. The flaw targets the plugin directories located in the root of each project and in the user's home directory under \.praisonai/plugins.

The CVSS score of 8.6 denotes a high‑severity remote code execution vulnerability. The EPSS score is reported as less than 1%, indicating a low probability of exploitation currently and that the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the ability to place a .py file in a recognized plugin directory; at that point the vulnerability can be triggered with minimal additional steps, which means that if an adversary can gain write access or compromise a dependency, the attack can be carried out straightforwardly.