Description

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, the shell() helper exported from src/praisonai-ts/src/tools/utility-tools.ts checks only the first whitespace-delimited token against safeCommands and then passes the complete original string to child_process.exec(). A string that starts with an allowed read-only command can append a second non-allowlisted command through shell syntax, allowing arbitrary command execution with the PraisonAI process privileges. This issue is fixed in version 1.7.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-15T11:17:10.437Z",
  "pubdate": "2026-09-15T11:17:10.437Z",
  "executiveSummary": "PraisonAI versions 1.5.1 through 1.7.2 contain a critical command injection vulnerability within the shell() helper function located in src/praisonai-ts/src/tools/utility-tools.ts.\nThe vulnerability arises from improper input validation where only the initial token of a command string is verified against an allowlist of safe commands.\nBy leveraging shell metacharacters, an attacker can bypass this security check to execute arbitrary system commands with the privileges of the PraisonAI process.\nThis flaw allows remote or local attackers to achieve full system compromise, data exfiltration, or lateral movement within the hosting environment.\nThe issue has been remediated in version 1.7.2, and immediate updates are required for all deployments using the affected version range.\nThis vulnerability is categorized as an improper neutralization of special elements used in an OS command, commonly known as command injection.",
  "technicalDetails": "The vulnerability resides in the shell() utility function, specifically in the logic used to validate user-supplied input before execution via child_process.exec().\nThe root cause is a flawed input validation mechanism that performs a tokenization operation by splitting the input string at the first whitespace character. The system checks only this initial token against a predefined list of 'safeCommands'.\nBecause child_process.exec() executes the entire input string within a shell environment (such as /bin/sh or cmd.exe), it interprets shell metacharacters like '&', '&&', '|', '||', or ';' as command separators.\nAn attacker can exploit this by crafting a payload that begins with an allowlisted command (e.g., 'ls'), followed by a separator and a malicious payload (e.g., 'ls && rm -rf /').\nThe validation logic identifies 'ls' as the first token, confirms it is in the safeCommands list, and passes the concatenated string 'ls && rm -rf /' to the underlying shell.\nThe shell then executes the safe command followed immediately by the attacker-supplied secondary command. This effectively bypasses the intended security controls and allows the execution of arbitrary commands with the full privileges of the application process.\nThis vulnerability is particularly dangerous because it does not require authentication to the underlying operating system and can be exploited remotely if the PraisonAI instance is exposed to user-provided input.\nThe attack flow is as follows: 1) The attacker provides a malicious string to the PraisonAI interface that triggers the shell() helper. 2) The input validation logic checks only the leading command. 3) The validation passes due to the presence of the safe prefix. 4) The complete command string is passed to child_process.exec(). 5) The shell interprets the metacharacters and executes the malicious payload alongside or instead of the intended command.\nThe exploit allows for complete post-exploitation impact, including environment variable theft, access to sensitive configuration files, unauthorized data modification, and potential deployment of persistent backdoors."
}