Description

PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, CommandValidator in src/praisonai-ts/src/cli/features/sandbox-executor.ts validates only the first whitespace-delimited executable against allowedCommands, then SandboxExecutor passes the complete command string to sh -c. A command beginning with an allowed executable can append a non-allowlisted command through shell metacharacters, causing arbitrary commands to run with the PraisonAI process privileges. This issue is fixed in version 1.7.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-15T11:17:10.883Z",
  "pubdate": "2026-09-15T11:17:10.883Z",
  "executiveSummary": "PraisonAI versions 1.2.3 through 1.7.2 are susceptible to a critical command injection vulnerability located within the SandboxExecutor component. The vulnerability arises from improper input validation in the CommandValidator, which fails to sanitize shell metacharacters when processing execution requests.\nBy bypassing the initial whitelist check, an attacker can execute arbitrary commands with the privileges of the PraisonAI process. This occurs because the system only validates the first whitespace-delimited executable, while the underlying shell execution mechanism allows for command chaining and injection through shell operators.\nThe risk implication is high, as successful exploitation leads to full remote code execution (RCE) on the host environment. Attackers do not necessarily require specialized authentication if the CLI interface is exposed to a malicious input vector. This vulnerability significantly compromises the confidentiality, integrity, and availability of the host system. Organizations utilizing affected versions of PraisonAI are at risk of system compromise and unauthorized data access. Remediation requires an immediate upgrade to version 1.7.2 or later to ensure the CommandValidator correctly handles shell metacharacters and prevents command concatenation.",
  "technicalDetails": "The vulnerability resides in the src/praisonai-ts/src/cli/features/sandbox-executor.ts file within the CommandValidator and SandboxExecutor functions. The root cause is a flawed input validation logic that relies on splitting the command string by the first whitespace character to determine if the executable is within an allowedCommands whitelist.\nWhen a user provides a command string, the CommandValidator checks the initial segment. If it matches an allowed executable, the system proceeds to pass the entire concatenated string directly to the sh -c command. Because sh -c invokes a shell, it interprets various metacharacters—such as semicolons (;), double ampersands (&&), pipe operators (|), or backticks (`)—as control sequences rather than literal arguments.\nAn attacker can exploit this by crafting a malicious payload that starts with a legitimate, allowed command followed by shell metacharacters to append unauthorized commands. For example, a payload structured as '[allowed_command] ; [malicious_command]' will successfully pass the initial validation check because the validator only evaluates '[allowed_command]'. Once validated, the entire string is handed to the shell, which executes the allowed binary and subsequently executes the malicious payload injected via the shell operator.\nThis behavior facilitates arbitrary command execution under the security context of the PraisonAI process. Since the SandboxExecutor is designed to execute commands in a sandboxed environment, this failure represents a significant breakout vulnerability. The attack flow involves: 1) Identification of the allowedCommands whitelist; 2) Crafting an input string that initiates with a whitelist entry; 3) Injecting command-chaining operators followed by the desired malicious payload; 4) Sending the crafted string to the SandboxExecutor component. Upon execution, the sh -c wrapper interprets the shell metacharacters, leading to the execution of the injected command with the privileges of the application process. This vulnerability affects all PraisonAI versions from 1.2.3 up to 1.7.2, and remediation is only achieved by applying the logic patch introduced in version 1.7.2, which improves the rigor of command validation and prevents shell-based command concatenation."
}