PraisonAIAgents before version 1.5.128 contains an OS command injection vulnerability (CWE-78) due to improper neutralization of special elements in user-controlled command strings passed to subprocess.run() with shell=True. The memory hooks executor executes these commands without sanitization, allowing shell metacharacters to be interpreted by /bin/sh. Two independent attack vectors exist: one via hook event types registered through configuration, and a more severe one via the .praisonai/hooks.json lifecycle configuration file, which can be overwritten by an agent with file-write access through prompt injection. This allows silent execution of arbitrary commands at lifecycle events without further user interaction. The vulnerability is resolved in version 1.5.128.

An attacker with limited privileges (local access with low privileges) can exploit this vulnerability to execute arbitrary OS commands with the privileges of the PraisonAIAgents process. The vulnerability allows silent and persistent command execution through lifecycle hooks, potentially leading to full system compromise or unauthorized actions. The CVSS 4.0 score is 9.3 (critical), reflecting high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported at this time.

Upgrade PraisonAIAgents to version 1.5.128 or later, where this vulnerability is fixed. Since no official patch advisory is provided, users should verify the version in use and apply the update promptly. Until upgraded, restrict file-write access to the .praisonai/hooks.json file and avoid registering untrusted hooks. Patch status is not explicitly confirmed beyond the version fix; check vendor sources for any additional guidance.