The vulnerability arises from the MCPToolIndex.search_tools() method in PraisonAI versions before 4.5.90, which compiles caller-supplied strings as Python regular expressions without any validation, sanitization, or timeout mechanism. This allows an attacker to supply a crafted regex pattern that triggers catastrophic backtracking in the Python regex engine, blocking the executing thread for an extended period and causing a denial of service. The issue is identified as CWE-1333 (Inefficient Regular Expression Complexity). The vendor has released version 4.5.90 which patches this vulnerability by presumably adding validation or timeout controls. There is no vendor advisory explicitly stating remediation level, but the patch availability is confirmed by the version update note.

Exploitation of this vulnerability results in a denial of service condition by causing the Python thread to block for hundreds of seconds due to catastrophic backtracking in regex processing. This leads to a complete service outage of PraisonAI instances running affected versions. There is no impact on confidentiality or integrity reported. No known exploits in the wild have been documented.

This vulnerability is patched in PraisonAI version 4.5.90. Users should upgrade to version 4.5.90 or later to remediate the issue. Since PraisonAI is not a cloud service, remediation requires applying the vendor's patch. Patch status is confirmed by the version update note; no additional vendor advisory is available. Until upgraded, avoid processing untrusted input as regular expressions in MCPToolIndex.search_tools().