CyberRota Analysis
AI-GeneratedPraisonAI versions prior to 1.6.78 are susceptible to a remote code execution vulnerability that allows attackers to execute arbitrary scripts by supplying absolute file paths, bypassing path containment validation in the SkillTools.run_skill_script() function. This could lead to unauthorized access and manipulation of system resources. Organizations using affected versions should prioritize remediation to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PraisonAI before 1.6.78 contains a remote code execution vulnerability in SkillTools.run_skill_script() that executes scripts without path containment validation. Attackers can supply absolute file paths to execute arbitrary scripts from any filesystem location, including those outside the intended working directory.