CVE-2026-62176: PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation

deploy/api.py in the PraisonAI package builds a server script with an f-string that contains PraisonAI(agent_file="{agents_file}") and the same value in an agent_file entry. It writes the script to disk and starts it with subprocess.Popen(['python', server_file]). Nothing validates agents_file. A value like "); import os; os.system("id"); # closes the string, adds a statement and comments out the rest, so that statement runs when the server starts. The same pattern appears in deploy/docker.py for Dockerfile generation.

The attacker must control the agents_file value: a CLI argument, a configuration file, or an upstream API that feeds the deploy command. The CVSS vector requires high privileges, so this is not an anonymous remote bug. It matters most in automation. A CI/CD pipeline or management service that takes an agents file name from a repo, a pull request or a request body hands code execution to whoever sets it. The code runs with the rights of the user running the deploy.

Affected: pip package PraisonAI 4.6.77 and earlier, if you use the deploy API server generation or the Docker deploy code and the agents_file value is not fully under your control.

pip show praisonai

Search your pipelines and scripts for deploy commands that take agents_file from external input.

Upgrade to PraisonAI 4.6.78.

pip install -U praisonai==4.6.78

The advisory does not describe the code change, and it does not say whether the patch covers deploy/docker.py as well as deploy/api.py. It lists no workaround. Until you upgrade, do not pass untrusted or externally sourced values as agents_file, and validate any such value before use. That is general advice, not vendor guidance.

Look for generated server files from the deploy command whose agent_file string contains quotes, semicolons or import. Check CI logs and deploy configuration for agents_file values that are not plain file paths. Review child Python processes started by the deploy command for unexpected shell calls such as os.system.

Summary

The deploy/api.py module generates Python server code by directly interpolating the agents_file parameter into an f-string that is then written to a file and executed via subprocess.Popen(). An attacker who controls the agents_file value (via CLI argument, configuration, or upstream API) can inject arbitrary Python code.

Details

src/praisonai/praisonai/deploy/api.py (line 80):

code = f'''...
    praisonai = PraisonAI(agent_file="{agents_file}")
...
    "agent_file": "{agents_file}"
...'''

The generated code is then executed (line 190):

subprocess.Popen(['python', server_file])

agents_file is never sanitized or validated. A malicious value breaks out of the string context:

agents_file = '"); import os; os.system("id"); #'
# Generated code becomes:
# praisonai = PraisonAI(agent_file=""); import os; os.system("id"); #")

The same pattern exists in deploy/docker.py (line 33) for Dockerfile generation.

PoC

# The injection:
agents_file = '"); import os; os.system("id"); #'

# What the generated code looks like:
template = f'praisonai = PraisonAI(agent_file="{agents_file}")'
print(template)
# Output: praisonai = PraisonAI(agent_file=""); import os; os.system("id"); #")

Impact

• Arbitrary code execution on the machine running the deploy command
• Supply chain risk if agents_file comes from a configuration file or CI/CD pipeline