PraisonAI, a multi-agent teams system, contains a code injection vulnerability (CWE-94) in versions before 4.5.115. Specifically, the create_agent_centric_tools() function returns tools such as acp_create_file that use template rendering on file content. When user input from agent.start() is passed directly into these tools without proper escaping, template expressions embedded in the input are executed, enabling code injection. This flaw allows an attacker with at least low privileges and no user interaction to execute arbitrary code, impacting confidentiality, integrity, and availability. The vulnerability is addressed by escaping user input in version 4.5.115.

Successful exploitation can lead to remote code execution with high impact on confidentiality, integrity, and availability of the affected system. The CVSS 3.1 score is 8.8 (high), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and full compromise potential. No known exploits are reported in the wild at this time.

A fix is available in PraisonAI version 4.5.115, which properly escapes user input to prevent template expression execution. Users should upgrade to version 4.5.115 or later to remediate this vulnerability. Since this is not a cloud service, remediation depends on applying the vendor's patch. Patch status is confirmed by the vendor advisory stating the issue is fixed in 4.5.115.