CVE-2026-61433

PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Python source code for API servers. Attackers can inject arbitrary Python expressions through the deploy.api.host and agents_file configuration parameters that execute when the generated server starts or handles requests.

PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Python source code for API servers. Attackers can inject arbitrary Python expressions through the deploy.api.host and agents_file configuration parameters that execute when the generated server starts or handles requests.

API deploy code generator embeds unescaped YAML fields into Python source

Summary

PraisonAI's API deployment generator copies deploy.api.host from agents.yaml directly into generated Python source without safe literal encoding. A malicious PraisonAI project can set that host value to a Python expression splice; when an operator runs the API deploy flow, the generated server source compiles and executes the injected expression at startup. The same generator also embeds agents_file directly into generated route-handler expressions, giving a second route-time source injection site if the agent file path is attacker-controlled.

Technical Details

The vulnerable path starts with deployment configuration parsing. Deploy.from_yaml() reads the operator-supplied agents.yaml, validate_agents_yaml() accepts deploy.api.host as a string, and API deployments call start_api_server(self.agents_file, self.config.api). start_api_server() calls generate_api_server_code() and executes the generated Python file with python.

The current generator in src/praisonai/praisonai/deploy/api.py treats deployment data as Python syntax:

def generate_api_server_code(agents_file: str, config: Optional[APIConfig] = None) -> str:
    ...
    code = f'''"""
...
        praisonai = PraisonAI(agent_file="{agents_file}")
...
        "agent_file": "{agents_file}"
...
    app.run(
        host='{config.host}',
        port={config.port},
        debug={config.reload}
    )
'''

The violated invariant is that deployment configuration values should remain inert strings. Instead, config.host is inserted between single quotes in generated Python source. A value like this breaks out of the generated string literal and evaluates a Python expression:

' + (__import__("pathlib").Path("poc.txt").write_text("DEPLOY_API_HOST_CODE_EXECUTED") and "") + '

The generated startup code then becomes equivalent to:

app.run(
    host='' + (__import__("pathlib").Path("poc.txt").write_text("DEPLOY_API_HOST_CODE_EXECUTED") and "") + '',
    port=8005,
    debug=False,
)

That expression executes before Flask handles any request. This is not a shell parsing issue and not just direct use of an unsafe Python API; it is a data-to-code transformation in the deployment generator.

agents_file has the same class of unsafe source interpolation in two generated route-handler expressions. A value shaped as " + (<side effect> and "") + " remains valid both in PraisonAI(agent_file=...) and in the /agents JSON response expression, so it executes when the generated handler evaluates that value.

PoV

The following local-only PoV stubs Flask and PraisonAI so it does not start a listener, invoke a model provider, or contact any external service. It proves that a malicious host value survives YAML schema parsing and executes when the generated server module is evaluated as __main__; it also includes a safe-host negative control and the secondary agents_file route-time interpolation check.

from pathlib import Path
import json
import sys
import tempfile
import types

import yaml


def install_stubs():
    class FakeApp:
        def __init__(self, name):
            self.name = name

        def route(self, *args, **kwargs):
            def deco(func):
                return func

            return deco

        def run(self, *args, **kwargs):
            return None

    flask = types.ModuleType("flask")
    flask.Flask = FakeApp
    flask.request = types.SimpleNamespace(headers={}, get_json=lambda: {"message": "hello"})
    flask.jsonify = lambda obj: obj
    sys.modules["flask"] = flask

    flask_cors = types.ModuleType("flask_cors")
    flask_cors.CORS = lambda app: app
    sys.modules["flask_cors"] = flask_cors

    praisonai_mod = types.ModuleType("praisonai")

    class FakePraisonAI:
        def __init__(self, agent_file):
            self.agent_file = agent_file

        def run(self):
        …

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-79fv-7hq9-w7xg. This link is maintained to preserve external references.

Original Description

PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Python source code for API servers. Attackers can inject arbitrary Python expressions through the deploy.api.host and agents_file configuration parameters that execute when the generated server starts or handles requests.

PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Python source code for API servers. Attackers can inject arbitrary Python expressions through the deploy.api.host and agents_file configuration parameters that execute when the generated server starts or handles requests.

PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Python source code for API servers. Attackers can inject arbitrary Python expressions through the deploy.api.host and agents_file configuration parameters that execute when the generated server starts or handles requests.

API deploy code generator embeds unescaped YAML fields into Python source

Summary

PraisonAI's API deployment generator copies deploy.api.host from agents.yaml directly into generated Python source without safe literal encoding. A malicious PraisonAI project can set that host value to a Python expression splice; when an operator runs the API deploy flow, the generated server source compiles and executes the injected expression at startup. The same generator also embeds agents_file directly into generated route-handler expressions, giving a second route-time source injection site if the agent file path is attacker-controlled.

Technical Details

The vulnerable path starts with deployment configuration parsing. Deploy.from_yaml() reads the operator-supplied agents.yaml, validate_agents_yaml() accepts deploy.api.host as a string, and API deployments call start_api_server(self.agents_file, self.config.api). start_api_server() calls generate_api_server_code() and executes the generated Python file with python.

The current generator in src/praisonai/praisonai/deploy/api.py treats deployment data as Python syntax:

def generate_api_server_code(agents_file: str, config: Optional[APIConfig] = None) -> str:
    ...
    code = f'''"""
...
        praisonai = PraisonAI(agent_file="{agents_file}")
...
        "agent_file": "{agents_file}"
...
    app.run(
        host='{config.host}',
        port={config.port},
        debug={config.reload}
    )
'''

The violated invariant is that deployment configuration values should remain inert strings. Instead, config.host is inserted between single quotes in generated Python source. A value like this breaks out of the generated string literal and evaluates a Python expression:

' + (__import__("pathlib").Path("poc.txt").write_text("DEPLOY_API_HOST_CODE_EXECUTED") and "") + '

The generated startup code then becomes equivalent to:

app.run(
    host='' + (__import__("pathlib").Path("poc.txt").write_text("DEPLOY_API_HOST_CODE_EXECUTED") and "") + '',
    port=8005,
    debug=False,
)

That expression executes before Flask handles any request. This is not a shell parsing issue and not just direct use of an unsafe Python API; it is a data-to-code transformation in the deployment generator.

agents_file has the same class of unsafe source interpolation in two generated route-handler expressions. A value shaped as " + (<side effect> and "") + " remains valid both in PraisonAI(agent_file=...) and in the /agents JSON response expression, so it executes when the generated handler evaluates that value.

PoV

The following local-only PoV stubs Flask and PraisonAI so it does not start a listener, invoke a model provider, or contact any external service. It proves that a malicious host value survives YAML schema parsing and executes when the generated server module is evaluated as __main__; it also includes a safe-host negative control and the secondary agents_file route-time interpolation check.

from pathlib import Path
import json
import sys
import tempfile
import types

import yaml


def install_stubs():
    class FakeApp:
        def __init__(self, name):
            self.name = name

        def route(self, *args, **kwargs):
            def deco(func):
                return func

            return deco

        def run(self, *args, **kwargs):
            return None

    flask = types.ModuleType("flask")
    flask.Flask = FakeApp
    flask.request = types.SimpleNamespace(headers={}, get_json=lambda: {"message": "hello"})
    flask.jsonify = lambda obj: obj
    sys.modules["flask"] = flask

    flask_cors = types.ModuleType("flask_cors")
    flask_cors.CORS = lambda app: app
    sys.modules["flask_cors"] = flask_cors

    praisonai_mod = types.ModuleType("praisonai")

    class FakePraisonAI:
        def __init__(self, agent_file):
            self.agent_file = agent_file

        def run(self):
        …

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-79fv-7hq9-w7xg. This link is maintained to preserve external references.

Original Description

PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Python source code for API servers. Attackers can inject arbitrary Python expressions through the deploy.api.host and agents_file configuration parameters that execute when the generated server starts or handles requests.

API deploy code generator embeds unescaped YAML fields into Python source

Summary

PraisonAI's API deployment generator copies deploy.api.host from agents.yaml directly into generated Python source without safe literal encoding. A malicious PraisonAI project can set that host value to a Python expression splice; when an operator runs the API deploy flow, the generated server source compiles and executes the injected expression at startup. The same generator also embeds agents_file directly into generated route-handler expressions, giving a second route-time source injection site if the agent file path is attacker-controlled.

Technical Details

The vulnerable path starts with deployment configuration parsing. Deploy.from_yaml() reads the operator-supplied agents.yaml, validate_agents_yaml() accepts deploy.api.host as a string, and API deployments call start_api_server(self.agents_file, self.config.api). start_api_server() calls generate_api_server_code() and executes the generated Python file with python.

The current generator in src/praisonai/praisonai/deploy/api.py treats deployment data as Python syntax:

def generate_api_server_code(agents_file: str, config: Optional[APIConfig] = None) -> str:
    ...
    code = f'''"""
...
        praisonai = PraisonAI(agent_file="{agents_file}")
...
        "agent_file": "{agents_file}"
...
    app.run(
        host='{config.host}',
        port={config.port},
        debug={config.reload}
    )
'''

The violated invariant is that deployment configuration values should remain inert strings. Instead, config.host is inserted between single quotes in generated Python source. A value like this breaks out of the generated string literal and evaluates a Python expression:

' + (__import__("pathlib").Path("poc.txt").write_text("DEPLOY_API_HOST_CODE_EXECUTED") and "") + '

The generated startup code then becomes equivalent to:

app.run(
    host='' + (__import__("pathlib").Path("poc.txt").write_text("DEPLOY_API_HOST_CODE_EXECUTED") and "") + '',
    port=8005,
    debug=False,
)

That expression executes before Flask handles any request. This is not a shell parsing issue and not just direct use of an unsafe Python API; it is a data-to-code transformation in the deployment generator.

agents_file has the same class of unsafe source interpolation in two generated route-handler expressions. A value shaped as " + (<side effect> and "") + " remains valid both in PraisonAI(agent_file=...) and in the /agents JSON response expression, so it executes when the generated handler evaluates that value.

PoV

The following local-only PoV stubs Flask and PraisonAI so it does not start a listener, invoke a model provider, or contact any external service. It proves that a malicious host value survives YAML schema parsing and executes when the generated server module is evaluated as __main__; it also includes a safe-host negative control and the secondary agents_file route-time interpolation check.

from pathlib import Path
import json
import sys
import tempfile
import types

import yaml


def install_stubs():
    class FakeApp:
        def __init__(self, name):
            self.name = name

        def route(self, *args, **kwargs):
            def deco(func):
                return func

            return deco

        def run(self, *args, **kwargs):
            return None

    flask = types.ModuleType("flask")
    flask.Flask = FakeApp
    flask.request = types.SimpleNamespace(headers={}, get_json=lambda: {"message": "hello"})
    flask.jsonify = lambda obj: obj
    sys.modules["flask"] = flask

    flask_cors = types.ModuleType("flask_cors")
    flask_cors.CORS = lambda app: app
    sys.modules["flask_cors"] = flask_cors

    praisonai_mod = types.ModuleType("praisonai")

    class FakePraisonAI:
        def __init__(self, agent_file):
            self.agent_file = agent_file

        def run(self):
        …