Anushkavirgaonkar

PraisonAI (praisonaiagents) before 1.6.78 contains a remote code execution vulnerability in the plugin manager, which loads and executes arbitrary Python (.py) files from project-level and user-home .praisonai/plugins/ directories using importlib spec from file location() and exec module() without code signing, integrity verification, or sandboxing. An attacker who can write a malicious .py file to a plugin directory (for example via path traversal, a supply chain attack, or a compromised dependency) achieves arbitrary code execution when the plugin system initializes.

**Name of the Vulnerable Software and Affected Versions** PraisonAI versions prior to 4.6.78 **Description** The AICoder component contains flaws allowing arbitrary file write and command execution. These issues result from missing path validation and inadequate command sanitization during Large Language Model (LLM) tool calls. An attacker can use the chat interface to inject malicious prompts, enabling them to write files to any location on the filesystem and execute shell commands with root privileges. **Recommendations** Update PraisonAI to version 4.6.78.

**Name of the Vulnerable Software and Affected Versions** PraisonAI versions prior to 1.6.78 **Description** A remote code execution issue exists in the `CodeAgent. execute python()` function. The software executes Python code generated by a Large Language Model (LLM) without Abstract Syntax Tree (AST) validation, import restrictions, or sandbox enforcement. An attacker can use prompt injection to influence the LLM output, allowing them to execute arbitrary code on the host system and exfiltrate environment secrets. This can occur if the agent processes untrusted input, such as customer support tickets, which may contain hidden instructions to execute malicious commands. **Recommendations** Update PraisonAI to version 1.6.78.

**Name of the Vulnerable Software and Affected Versions** PraisonAI versions prior to 4.6.78 **Description** A code injection issue exists in the `deploy/api.py` file. The `agents file` parameter is directly interpolated into an f-string without proper sanitization. This interpolated string is used to generate server code that is subsequently executed via the `subprocess.Popen()` function. An authorized user with access to the deploy API can exploit this to inject and execute arbitrary Python code within the context of the deployment process. **Recommendations** Update PraisonAI to version 4.6.78. Avoid using the `agents file` parameter in the `deploy/api.py` endpoint until the update is applied.