PraisonAI's workflow engine in versions below 4.5.139 and praisonaiagents below 1.5.140 processes YAML files with type: job that include steps executing shell commands (via subprocess.run()), inline Python code (via exec()), and arbitrary Python scripts without any input validation, sandboxing, or user confirmation. The vulnerable code paths include action_run() in workflow.py and _exec_shell(), _exec_inline_python(), and _exec_python_script() in job_workflow.py. An attacker able to supply or influence such YAML files—common in CI pipelines, shared repositories, or multi-tenant environments—can achieve arbitrary code execution on the host system, leading to full system compromise and access to sensitive data or credentials. The issue has been addressed in PraisonAI 4.5.139 and praisonaiagents 1.5.140.

Successful exploitation allows an unauthenticated attacker who can supply or influence workflow YAML files to execute arbitrary OS commands and Python code on the host system. This leads to full compromise of the affected machine, including confidentiality, integrity, and availability impacts. The attacker can access sensitive data, credentials, and potentially pivot within the environment. The vulnerability has a CVSS 3.1 score of 9.8 (critical).

A fix is available in PraisonAI version 4.5.139 and praisonaiagents version 1.5.140. Users should upgrade to these or later versions to remediate this vulnerability. Until patched, avoid running untrusted or unauthenticated YAML workflow files, especially in CI pipelines, shared repositories, or multi-tenant deployments. Patch status is confirmed by the vendor advisory stating the issue is fixed in these versions.