PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component due to missing path validation and command sanitization in LLM tool calls. Attackers can inject malicious prompts through the chat interface to write files to arbitrary filesystem locations and execute arbitrary shell commands with root privileges.

Affected: PyPI: praisonai

### Summary The `AICoder` UI component exposes `write_to_file` and `execute_command` tools to the LLM with no path validation and no command sanitization. An attacker can achieve arbitrary file write to any location on the filesystem (including `/root/.ssh/authorized_keys`, `/etc/crontab`) and arbitrary command execution through prompt injection in the chat interface. Docker containers run as root, maximizing impact.

### Details

#### Path Traversal in write_to_file

`src/praisonai/praisonai/ui/components/aicoder.py` (lines 122-131):

```python async def write_to_file(self, file_path, content, existing=False): if not existing: await self.create_directories(file_path) try: with open(file_path, 'w') as file: # No path validation file.write(content) return True except Exception as e: return False ```

The `apply_llm_response` method at line 269 uses `os.path.join` which does not prevent absolute paths: ```python file_path = os.path.join(self.cwd, args["path"].strip()) # os.path.join("/app", "/etc/passwd") = "/etc/passwd" ```

#### Command Injection in execute_command

`src/praisonai/praisonai/ui/components/aicoder.py` (lines 159-180):

```python async def execute_command(self, command: str): cmd_args = self.get_shell_command(command) process = await asyncio.create_subprocess_exec( *cmd_args, stdout=asyncio.subprocess.PIPE, stderr=asyncio.subprocess.PIPE, cwd=self.cwd ) ```

No…