# PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source

PraisonAI's API deploy generator interpolates deploy.api.host and agents_file into generated Python source unescaped, so a malicious agents.yaml executes arbitrary Python when the operator deploys.

- Payout: Research
- Severity: high
- Program: PraisonAI
- Found by (vendor credit): rexpository
- Found by: rexpository
- Disclosed: 2026-10-08
- CVE: CVE-2026-61433
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-79fv-7hq9-w7xg
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-79fv-7hq9-w7xg
- Tags: area:ai domain:ai domain:oss impact:rce kind:research platform:ghsa sev:high tech:python technique:source-review vuln:command-injection vuln:rce

**Target:** PraisonAI deploy API code generator (deploy/api.py generate_api_server_code)
**Root cause:** generate_api_server_code() f-strings deployment config values (config.host, agents_file) directly into generated Python source between quotes instead of using repr()/json.dumps(), so a value containing a quote breaks out of the string literal into executable expression context.
**Steps:**
1. Craft agents.yaml with deploy.type=api and deploy.api.host set to `' + (__import__("pathlib").Path("poc.txt").write_text("DEPLOY_API_HOST_CODE_EXECUTED") and "") + '`
2. Run validate_agents_yaml()/Deploy.from_yaml() — the payload survives schema validation as a plain string
3. Call generate_api_server_code(agents_file, config) and observe the raw host spliced into `host='{config.host}'`
4. compile()/exec() the generated module as __main__; the injected expression runs at startup before Flask serves any request
5. Secondary: pass agents_file shaped as `" + (<side effect> and "") + "`; it executes when the generated /agents handler evaluates the response expression
**How found:** Code review of the deploy generator: noticed deployment config values treated as Python syntax inside f-string source templates, then tested whether a quote-splice payload survives YAML schema validation and executes at generated-module startup.
**Exploitation:** Operator deploys a malicious PraisonAI project config; the generated API server source is compiled and run with python, executing the injected expression in the deploy process with access to environment, source tree, local files, model/API credentials and deployment credentials.
**Insight:** When auditing code generators, grep for f-string templates that place config values inside quoted Python literals; test whether the config schema validator preserves quote/expression-splice strings, and check every interpolation site (including route-handler response expressions) for a second execution point.