Praisonai EUVD-2026-22207

Attacker must place malicious tools.py in the directory where PraisonAI versions ≤4.5.138 is launched (shared project, cloned repository, or writable workspace). Local access required; no authentication or user interaction needed. Exploited automatically at startup.

Real-world risk is HIGH despite the local attack vector (AV:L) due to modern development workflow realities. The CVSS 8.4 score reflects complete confidentiality, integrity, and availability impact (C:H/I:H/A:H) with low attack complexity (AC:L) and no required privileges (PR:N) or user interaction (UI:N). While AV:L typically suggests lower priority, this vulnerability exploits realistic attack scenarios: developers cloning untrusted repositories, teams sharing project directories, containerized environments with mounted volumes, and CI/CD pipelines processing external code. The automatable nature (executes on startup without user action) significantly elevates risk in automated deployment pipelines. No EPSS score available for quantitative exploitation probability, but the triviality of exploitation (simply place a Python file) combined with widespread use of shared development environments makes this practically weaponizable. No confirmed active exploitation (CISA KEV) at time of analysis, and no public exploit identified, but proof-of-concept would be trivial to construct. The SSVC framework would classify this as high technical impact (arbitrary code execution), low-to-medium exploitation likelihood (requires local file write access), and automatable in supply chain contexts. The gap between 8.4 CVSS and real-world urgency depends entirely on organizational workspace hygiene and whether PraisonAI is used in multi-tenant or shared development environments.

An attacker contributes to an open-source project or shares a collaborative workspace containing a malicious tools.py file disguised as legitimate AI tool extensions. When a developer clones the repository and runs PraisonAI commands for testing (such as 'praisonai --auto'), the application automatically imports and executes the attacker's tools.py code without warnings. The malicious code exfiltrates environment variables containing API keys and credentials, establishes a reverse shell to the attacker's infrastructure, and persists by modifying the developer's shell configuration files, all executing with the developer's full system privileges.