CyberRota Analysis
AI-GeneratedPraisonAI versions prior to 4.6.78 are susceptible to a critical code injection vulnerability in the deploy/api.py file, where the agents_file parameter is unsanitized and directly interpolated into an f-string. This flaw allows attackers to execute arbitrary Python code through subprocess.Popen(), potentially compromising the server. Organizations using affected versions should prioritize immediate updates to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PraisonAI versions before 4.6.78 contain a code injection vulnerability in deploy/api.py where the agents_file parameter is directly interpolated into an f-string without sanitization. Attackers can inject arbitrary Python code that executes when the generated server code runs via subprocess.Popen().