PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls

[ Why it matters ]Priority signals

• Public proof-of-concept exploit exists (CISA SSVC)
• Critical severity: CVSS 9.9

[ Description ]Official description

PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component due to missing path validation and command sanitization in LLM tool calls. Attackers can inject malicious prompts through the chat interface to write files to arbitrary filesystem locations and execute arbitrary shell commands with root privileges.

[ Fixes ]Fixes and patches

• praisonai 4.6.78Fixed version · GitHub Advisories · pip package praisonai: upgrade to 4.6.78 or later (affected <= 4.6.77)

[ Packages ]Affected open-source packages

• praisonai pipAffected <= 4.6.77 · fixed in 4.6.78 · GHSA-9mp3-24cc-77mg

[ References ]References

• github.com/MervinPraison/PraisonAI/security/advisories/GHSA-9mp3-24cc-77mgvendor-advisory
• www.vulncheck.com/advisories/praisonai-before-arbitrary-file-write-and-command-executionthird-party-advisory