PraisonAI versions 4.5.138 and below allow unauthenticated attackers to achieve arbitrary code execution on the host system by placing a malicious tools.py file in the project directory.

The application suffers from improper control of code generation and untrusted search path vulnerabilities. It blindly imports and executes code from a local tools.py file without validation, allowing an attacker with local file write access to execute arbitrary Python code in the host environment.

Successful exploitation grants an attacker full control over the PraisonAI process and the host system. Given the CVSS score of 8.4, this vulnerability represents a high risk, as it enables total compromise of sensitive data, credentials, and system integrity within the environment where the AI agent is deployed.

Immediate Action: Update the PraisonAI package to version 4.5.139 and praisonaiagents to version 1.5.140 immediately.

Proactive Monitoring: Audit directory permissions for all project workspaces to ensure that untrusted users cannot write files to the directories where PraisonAI is executed.

Compensating Controls: Execute the application within a strictly isolated environment, such as a container or sandbox with read-only access to unnecessary files, to limit the impact of potential code execution.

Public Exploit Available: Unknown

This is a critical security flaw that requires immediate attention due to the ease of exploitation and the severity of the potential impact. Organizations must prioritize updating their PraisonAI instances to the specified fixed versions to eliminate the risk of arbitrary code execution. Failure to patch may expose the host infrastructure to unauthorized access and total system compromise.