Summary
A code injection vulnerability in PraisonAI allows attacker-controlled agents_file input to be embedded directly into generated Python server code. When the generated file is executed, an attacker who can control this value may run arbitrary Python code with the privileges of the PraisonAI process.
A code injection vulnerability in PraisonAI allows attacker-controlled agents_file input to be embedded directly into generated Python server code. When the generated file is executed, an attacker who can control this value may run arbitrary Python code with the privileges of the PraisonAI process.
Affected context
The vulnerability affects PraisonAI deployments that use the deploy/api.py module to generate and execute Python server code. Risk is present when the agents_file parameter can be influenced through a command-line argument, configuration source, or upstream API and is incorporated into generated source code without being treated strictly as data.
The vulnerability affects PraisonAI deployments that use the deploy/api.py module to generate and execute Python server code. Risk is present when the agents_file parameter can be influenced through a command-line argument, configuration source, or upstream API and is incorporated into generated source code without being treated strictly as data.
Exploit preconditions
- Attack surface: The PraisonAI deployment API and related configuration or command-line interfaces
- Required access: Ability to control or influence the
agents_fileparameter - Trigger point: Generation and subsequent execution of the Python server file
- Why exploitation is possible: The parameter is interpolated into executable Python source rather than safely passed as inert data
- Attack surface: The PraisonAI deployment API and related configuration or command-line interfaces
- Required access: Ability to control or influence the
agents_fileparameter - Trigger point: Generation and subsequent execution of the Python server file
- Why exploitation is possible: The parameter is interpolated into executable Python source rather than safely passed as inert data
Why this happens
The underlying flaw is unsafely constructing executable source code with attacker-influenced input. Direct interpolation into an f-string allows input to alter the structure and behavior of the generated Python program before it is executed through a subprocess. This behavior maps to CWE-94: Improper Control of Generation of Code, because untrusted data is permitted to become executable code.
The underlying flaw is unsafely constructing executable source code with attacker-influenced input. Direct interpolation into an f-string allows input to alter the structure and behavior of the generated Python program before it is executed through a subprocess. This behavior maps to CWE-94: Improper Control of Generation of Code, because untrusted data is permitted to become executable code.
Potential impact
- An attacker may execute arbitrary Python code
- The application process could be compromised
- Sensitive files, credentials, or environment variables may be exposed
- The attacker could alter generated services or application data
- Further compromise may be possible if the process has elevated permissions or broad network access
- An attacker may execute arbitrary Python code
- The application process could be compromised
- Sensitive files, credentials, or environment variables may be exposed
- The attacker could alter generated services or application data
- Further compromise may be possible if the process has elevated permissions or broad network access
General mitigation guidance
Mitigation generally focuses on preventing untrusted values from entering generated source code.
Common defensive patterns include:
- Treating
agents_fileas data and passing it through structured interfaces rather than source-code interpolation - Using fixed templates with explicit parameter binding instead of dynamically assembled executable code
- Applying strict allowlists, schema validation, and canonicalization to file references and configuration values
- Restricting accepted paths to approved locations and preventing unexpected file or module references
- Running generated services with least privilege, isolated credentials, and limited filesystem and network access
- Reducing trust in upstream APIs and configuration providers through authentication, authorization, and integrity controls
Mitigation generally focuses on preventing untrusted values from entering generated source code.
Common defensive patterns include:
- Treating
agents_fileas data and passing it through structured interfaces rather than source-code interpolation - Using fixed templates with explicit parameter binding instead of dynamically assembled executable code
- Applying strict allowlists, schema validation, and canonicalization to file references and configuration values
- Restricting accepted paths to approved locations and preventing unexpected file or module references
- Running generated services with least privilege, isolated credentials, and limited filesystem and network access
- Reducing trust in upstream APIs and configuration providers through authentication, authorization, and integrity controls
How teams detect issues like this
Detection can include static analysis for f-strings, string formatting, or template operations whose results are written to Python files and executed by subprocess APIs. Code review should flag attacker-controlled values crossing into source-generation, dynamic imports, evaluation, or process-launch boundaries.
Organizations may also enforce policies that prohibit runtime code generation from untrusted inputs, require schema validation for deployment parameters, and monitor generated files and subprocess launches. Automated security review tools can help identify these data-to-code flows during development.
Detection can include static analysis for f-strings, string formatting, or template operations whose results are written to Python files and executed by subprocess APIs. Code review should flag attacker-controlled values crossing into source-generation, dynamic imports, evaluation, or process-launch boundaries.
Organizations may also enforce policies that prohibit runtime code generation from untrusted inputs, require schema validation for deployment parameters, and monitor generated files and subprocess launches. Automated security review tools can help identify these data-to-code flows during development.
Sources
| Source | Link |
|---|---|
| github. | github.com/ |
