The vulnerability permits attackers to execute arbitrary Python code on the host system. By influencing the chosen LLM’s output through prompt injection, an attacker can cause the embedded CodeAgent._execute_python() call to run LLM‑generated scripts without any AST validation, import restrictions, or sandbox enforcement, allowing full access to environment secrets and system resources.

MervinPraison’s PraisonAI product is impacted. All releases prior to version 1.6.78 are affected; later versions contain the fix.

This issue carries a CVSS score of 10, marking it as a severely dangerous flaw. The EPSS score of less than 1% indicates that exploitation is unlikely to be widespread, but the absence of input validation makes exploitation practically trivial once an attacker can influence the LLM’s output. The most likely entry point is through a remote API or web interface that accepts user prompts, although the vulnerability is currently not listed in the CISA KEV catalog.