A critical unauthenticated command injection vulnerability in PraisonAI allows attackers to execute arbitrary system commands, posing a severe risk of total system compromise.

This flaw involves an OS command injection vulnerability (CWE-78) combined with missing authentication (CWE-306) on the /api/mcp/connect endpoint, which allows unauthenticated remote attackers to pass arbitrary commands to the StdioMCPClient process.

The CVSS score of 9.8 reflects the critical nature of this vulnerability, as it requires no user interaction or authentication to achieve full system control. Successful exploitation could lead to complete data theft, unauthorized modification of system resources, or the deployment of persistent malware, resulting in significant operational downtime and severe reputational damage.

Immediate Action: Update the PraisonAI package to version 4.6.59 or later immediately to incorporate the necessary authentication checks and command sanitization.

Proactive Monitoring: Monitor network traffic for anomalous POST requests directed at the /api/mcp/connect endpoint and inspect system logs for unexpected process spawning initiated by the UI service account.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block unauthorized access to the /api/mcp/connect endpoint and ensure the service is not exposed to the public internet by binding it to localhost or a restricted internal interface.

Public Exploit Available: Unknown.

Given the critical severity and the ease of exploitation, organizations must prioritize patching this vulnerability immediately. Failure to update to version 4.6.59 leaves the host system entirely exposed to remote command execution, which could be leveraged to gain full administrative control over the underlying infrastructure.