PraisonAI Vulnerable to Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars

An attacker can exploit this vulnerability by crafting environment variable values containing commas within the openaimodel, openaikey, or openai_base parameters. This injection causes the gcloud command to misinterpret the comma as a key-value separator, leading to the execution of attacker-controlled environment variables within the deployed Cloud Run service. Successful exploitation grants the attacker the ability to execute arbitrary code within the Cloud Run container, potentially leading to complete system compromise, data exfiltration, and lateral movement within the Google Cloud environment. The blast radius extends to any data processed or stored by the compromised Cloud Run service.

Organizations using praisonai to deploy AI models to Google Cloud Run are at risk, particularly those relying on user-provided or external data for the openaimodel, openaikey, and openai_base environment variables. Shared hosting environments or deployments with lax input validation practices are especially vulnerable.

• python / server:

import os
import subprocess

def check_deploy_script(filepath):
    with open(filepath, 'r') as f:
        content = f.read()
    if 'gcloud run deploy --set-env-vars' in content and 'openai_model' in content and 'openai_key' in content and 'openai_base' in content and ',' in content:
        return True
    return False

# Example usage
filepath = 'deploy.py'
if check_deploy_script(filepath):
    print(f'Potential vulnerability detected in {filepath}')
else:
    print('No vulnerability detected.')

• generic web:

curl -I <your_cloud_run_service_url>

Inspect the response headers for any unexpected or suspicious environment variables that might indicate exploitation.

1. 2026-04-10Disclosure

   disclosure

2. 2026-04-10Patch

   patch

1. Reservado2026-04-09
2. Publicada2026-04-10
3. EPSS atualizado2026-04-17

The primary mitigation is to upgrade praisonai to version 4.5.128 or later, which includes the necessary input validation to prevent the comma injection. If an immediate upgrade is not feasible, consider implementing a temporary workaround by sanitizing the openaimodel, openaikey, and openai_base values before passing them to the gcloud command. This could involve removing or replacing commas with a safe alternative. Additionally, review Cloud Run service permissions to limit the potential impact of a successful exploit. After upgrading, confirm the fix by running deploy.py with a test environment variable containing a comma and verifying that the environment variable is not injected.