PraisonAI versions from 4.5.139 to before 4.6.32 contain a code injection vulnerability (CWE-94) due to an unguarded import sink in praisonai/templates/tool_override.py. While previous fixes gated auto-imports in two files behind an environment variable, this third location remained exposed. The vulnerability is triggered remotely via POST /v1/recipes/run by specifying a recipe that points to a local absolute path or any GitHub repository, leveraging the default SecurityConfig.allow_any_github=true setting. An attacker can drop a malicious tools.py file adjacent to TEMPLATE.yaml, which the server then executes via exec_module(), enabling arbitrary code execution without authentication. The vulnerability is patched in version 4.6.32.

Successful exploitation allows unauthenticated remote attackers with network-level access to execute arbitrary code on the PraisonAI server, compromising confidentiality, integrity, and availability. The vulnerability affects all installations running affected versions with default configurations, potentially leading to full system compromise. There are no known exploits in the wild at this time.

This vulnerability is fixed in PraisonAI version 4.6.32. Users should upgrade to version 4.6.32 or later to remediate this issue. Until upgrading, restricting network access to the /v1/recipes/run endpoint and disabling or carefully configuring SecurityConfig.allow_any_github may reduce exposure. Patch status is not explicitly stated beyond the version fix; therefore, verify with the vendor advisory for the latest remediation guidance.