PraisonAI EUVD-2026-28639

Requires the PraisonAI MCP server component to be actively running via 'praisonai mcp serve' command - this is NOT enabled by default and must be explicitly started by the user. The victim user or an AI agent under their control must invoke one of the vulnerable MCP tools (praisonai.rules.create, praisonai.rules.delete, or praisonai.workflow.show) with attacker-controlled path arguments, typically through a compromised AI workflow, malicious integration, or social engineering of the user to process untrusted MCP commands. The running user must have write permissions to Python site-packages directories (~/.local/lib/python*/site-packages on Linux/macOS or AppData\Roaming\Python on Windows) for full code execution escalation; without site-packages access, the impact reduces to arbitrary file write in user-writable locations. Exploitation is limited to scenarios where MCP tool call parameters can be influenced by untrusted sources, which constrains the attack to multi-tenant AI platforms, AI agent systems processing external inputs, or environments where users are tricked into running malicious MCP commands.

Real-world risk requires careful contextualization of the 9.4 CVSS score. The CVSS:4.0 vector shows maximum impact (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) across confidentiality, integrity, and availability for both vulnerable and subsequent systems, indicating full system compromise potential. Attack vector is network-based (AV:N) with low complexity (AC:L) and no required privileges (PR:N), but critically requires user interaction (UI:P) - the user must trigger MCP tool calls with attacker-controlled arguments, likely through a compromised AI agent workflow or social engineering. No EPSS score provided, but absence from CISA KEV and no public POC suggests limited current exploitation. The detailed GitHub security advisory (GHSA-9mqq-jqxf-grvw) provides exploitation mechanics, lowering the barrier for capable attackers. Primary risk is in environments where untrusted users or AI agents can invoke PraisonAI MCP tools with arbitrary parameters, particularly multi-tenant AI development platforms or systems processing untrusted AI workflows. Organizations not running the mcp serve component or not exposing MCP tool calls to untrusted sources face minimal risk despite the high CVSS.

An attacker crafts a malicious MCP tool call JSON-RPC request targeting a PraisonAI MCP server, setting rule_name parameter to '../../.local/lib/python3.11/site-packages/malicious.pth' in the praisonai.rules.create tool. The server writes attacker-controlled content (Python code) to this traversed path without validation. When the victim user next launches any Python process (running 'praisonai' command, opening a Python IDE, or executing background Python services), the Python interpreter loads malicious.pth during initialization and executes the embedded code with the user's full privileges, establishing persistence and potentially pivoting to other systems accessible from the compromised account.