PraisonAI hat CRITICAL RCE über Workflow YAML mit `type: job`

The vulnerability lies within the praisonai workflow run <file.yaml> command, which loads YAML files and executes steps defined within them. Specifically, the JobWorkflowExecutor in job_workflow.py is susceptible to exploitation. The run:, script:, and python: directives within the YAML file are the attack vectors. The run: directive allows arbitrary shell command execution via subprocess.run(), the script: directive enables inline Python code execution using exec(), and the python: directive allows the execution of arbitrary Python scripts. An attacker could craft a malicious YAML file to gain complete control of the system, potentially leading to data breaches, system compromise, and further lateral movement within the network.

Organizations utilizing praisonaiagents for workflow automation, particularly those with untrusted YAML file inputs, are at significant risk. Environments where the praisonai workflow run command is exposed to external users or systems are especially vulnerable. Teams relying on praisonaiagents for critical infrastructure or sensitive data processing should prioritize remediation.

• python / server:

Get-Process -Name praisonaiagents | Select-Object -ExpandProperty Path

• python / server:

journalctl -u praisonaiagents -g 'subprocess.run' | grep -i 'exploit.yaml'

• python / server:

ps aux | grep -i 'exec(' | grep -i 'praisonaiagents'

1. 2026-04-10Disclosure

   disclosure

2. 2026-04-10PoC

   poc

1. Reserviert2026-04-10
2. Veröffentlicht2026-04-10
3. Geändert2026-04-14
4. EPSS aktualisiert2026-04-21

The primary mitigation is to upgrade to praisonaiagents version 1.5.140 or later, which contains the fix for this vulnerability. If upgrading immediately is not feasible, consider implementing temporary workarounds. Restrict the YAML files that can be processed by the praisonai workflow run command to trusted sources only. Implement strict input validation to sanitize YAML content before processing. Consider using a Web Application Firewall (WAF) or proxy to filter potentially malicious YAML payloads. After upgrading, confirm the fix by attempting to execute a known malicious YAML file (from the PoC) and verifying that it is blocked or handled safely.