PraisonAI, a multi-agent teams system, versions prior to 4.5.139 automatically import a tools.py file from the current working directory without validation or sandboxing. Components such as call.py (import_tools_from_file()), tool_resolver.py (_load_local_tools()), and CLI tool-loading paths blindly import this file at startup. This behavior enables an attacker with write access to the launch directory to execute arbitrary Python code, leading to full compromise of the PraisonAI process and the host environment. The issue is identified as CWE-94 (Improper Control of Generation of Code) and CWE-426 (Untrusted Search Path). The vulnerability has been addressed in version 4.5.139.

Successful exploitation results in immediate arbitrary code execution with the privileges of the PraisonAI process. This compromises the entire PraisonAI application, the underlying host system, and any data or credentials accessible to the process. The CVSS v3.1 score is 8.4 (High), reflecting high confidentiality, integrity, and availability impacts. There are no known exploits in the wild at this time.

Upgrade PraisonAI to version 4.5.139 or later, where this vulnerability is fixed. Until upgrading, avoid launching PraisonAI from directories where untrusted users can place or modify a tools.py file. Restrict write permissions on the working directory to trusted users only. Patch status is confirmed fixed in version 4.5.139.