praisonaiagents EUVD-2026-65501

Exploitation requires that the PraisonAI agent has ast_grep_rewrite registered as a callable tool, which occurs when the code_intelligence built-in profile is active or when the tool is manually registered. The ast-grep CLI must be installed in the system PATH. The LLM must invoke the function with dry_run=False - a parameter the model controls directly - and must supply a path and pattern that match target files. A human operator must initiate the agent session (UI:R per CVSS), but the file rewrite occurs without further operator interaction or approval once the session is running. Exploitation is not possible if the code_intelligence profile is disabled, if ast_grep_rewrite is not registered as a tool, if the ast-grep CLI is absent from the PATH, or if dry_run is externally forced to True. The attacker cannot exfiltrate file contents - impact is limited to in-place integrity modification of files accessible to the process user.

The CVSS 3.1 score of 6.1 (Medium) reflects a local attack vector (AV:L) and absent confidentiality impact, which moderate the score despite the high integrity impact of arbitrary file rewriting. The real-world risk is higher than this score suggests in agentic deployment contexts - the local vector is expected behavior for agent frameworks, and the relevant threat model is an LLM being manipulated via prompt injection to issue unauthorized tool calls, not a conventional local-access exploit. No EPSS data was available in the provided intelligence. The vulnerability is not in CISA KEV. Publicly available exploit code exists, confirmed by the proof-of-concept included in GHSA-cfxv-8fw8-rwpv, establishing that exploitation is practical without special tooling beyond installing praisonaiagents and the ast-grep CLI. A secondary silent-failure defect - the function returns 'No changes made' even after modifying files - substantially impairs detection and post-incident forensics, increasing operational risk beyond what the CVSS score captures. Organizations running automated agentic coding pipelines that expose the code_intelligence profile should treat this as a priority fix independent of the moderate base score.

An attacker crafts adversarial input - via prompt injection in a document processed by the agent or a malicious task description - causing the LLM to call ast_grep_rewrite with dry_run=False, a destructive rewrite pattern, and a broad filesystem path such as the project root. Because the @require_approval gate is absent, the ast-grep CLI immediately rewrites all matching source files without operator confirmation, and the function then returns 'No changes made' to the LLM caller, suppressing any indication of the write in session logs. A self-contained proof-of-concept demonstrating this sequence is included in GHSA-cfxv-8fw8-rwpv.