PraisonAI versions before 4.6.9 contain an OS command injection vulnerability (CWE-78) due to insufficient input validation in the parse_mcp_command() function. The lack of a command allowlist or argument validation allows attackers to execute arbitrary commands by passing executables such as bash, python, or /bin/sh with inline code execution flags to subprocess calls. This vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity. The vulnerability was addressed by patching in version 4.6.9, which presumably adds proper validation to prevent arbitrary command execution.

Successful exploitation of this vulnerability allows unauthenticated remote attackers to execute arbitrary OS commands with the privileges of the PraisonAI process. This can lead to full system compromise, including confidentiality, integrity, and availability impacts. The CVSS score of 9.8 reflects the high impact on confidentiality, integrity, and availability without requiring privileges or user interaction.

A fix is available in PraisonAI version 4.6.9, which addresses this vulnerability by implementing proper command allowlisting and argument validation in the parse_mcp_command() function. Users should upgrade to version 4.6.9 or later to remediate this issue. Since the vendor advisory is not explicitly provided, patch status is inferred from the description stating the issue is patched in 4.6.9. No additional mitigations are specified.