PraisonAI’s Deploy API Server Generation module builds Python code from an f‑string that directly includes the agents_file parameter. This code is written to disk and executed by subprocess.Popen(), allowing an attacker who can control the agents_file value to inject arbitrary Python statements. The injection is a classic code injection flaw (CWE‑94), giving the attacker full compromise of the execution environment, potentially leading to data exfiltration, persistence, or additional malware deployment.

MervinPraison PraisonAI, all releases earlier than version 4.6.78. Users of the deploy API or processes that can set the agents_file argument without proper validation are at risk.

The CVSS score of 9.1 indicates a high severity, and though an EPSS score is not available, the lack of mitigation in the affected versions makes exploitation highly likely for any system that processes user input for agents_file. The flaw is not listed in CISA’s KEV catalog, but the functional nature of the code injection provides a straightforward attack path: a remote client or local attacker can supply a crafted agents_file value to the API, resulting in the server executing arbitrary code. This inference assumes the API or configuration setting is reachable by an attacker, which is typical for services exposed to external inputs.