PraisonAI versions before 1.5.90 contain an OS command injection vulnerability (CWE-78) in the run_python() function. This function builds a shell command string by inserting user-controlled code into a python3 -c "<code>" command executed with subprocess.run(..., shell=True). The escaping mechanism only handles backslashes and double quotes, leaving shell command substitution constructs like $() and backticks unescaped. This allows an attacker with limited privileges to execute arbitrary OS commands on the host system before the Python interpreter is invoked. The vulnerability is patched in version 1.5.90.

Successful exploitation allows an attacker with local privileges to execute arbitrary operating system commands with the privileges of the PraisonAI process. This can lead to full compromise of the affected system's confidentiality, integrity, and availability. The CVSS score of 7.8 reflects high impact on confidentiality, integrity, and availability. There are no reports of active exploitation in the wild.

Upgrade PraisonAI to version 1.5.90 or later, where this vulnerability has been patched. Since no official vendor advisory or patch link is provided, verify the version upgrade from the vendor's official sources. No additional mitigations are specified or required beyond applying the fixed version.