CVE-2026-57117 in PraisonAI
Summary
by MITRE • 10/23/2026
PraisonAI is a multi-agent teams system. From version 4.6.10 to before version 4.6.59, LocalManagedAgent / SandboxedAgent compute bridging wraps read_file, list_files, and write_file when a compute provider is attached. The bridge converts those file operations into shell command strings using raw path arguments, then sends those strings to shell-backed compute providers. An attacker who can influence a file-tool path argument can break out of the quoted path and execute arbitrary shell commands in the compute environment. With compute="local", commands execute through the local subprocess compute provider on the host. With Docker, commands execute in the container. This issue has been patched in version 4.6.59.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in PraisonAI versions ranging from 4.6.10 to those preceding 4.6.59 represents a critical command injection flaw within its multi-agent team architecture, specifically affecting the LocalManagedAgent and SandboxedAgent components when operating with an attached compute provider. This system is designed to facilitate complex workflows by allowing agents to perform file operations such as reading, listing, and writing files through a bridging mechanism that translates high-level tool calls into executable shell commands for backend compute environments. The core technical flaw lies in the implementation of this bridge, which constructs shell command strings using raw path arguments without adequate sanitization or proper escaping mechanisms. When an agent invokes these file tools, the system directly interpolates user-supplied or dynamically generated file paths into a shell execution string. This design choice creates a classic injection vector where special characters within the filename can be interpreted by the underlying shell as control operators rather than literal path components.
An attacker who gains the ability to influence the arguments passed to these file tools, such as through malicious agent behavior in an untrusted multi-agent setup or via compromised input data processed by the agents, can exploit this weakness to achieve arbitrary command execution. By injecting shell metacharacters like semicolons, pipes, or backticks into a filename argument, the attacker can break out of the intended quoted path context. For instance, if the system wraps paths in quotes but fails to escape internal quote characters or handles spaces and special symbols incorrectly, an input such as "test; rm -rf /" could result in the shell executing both the file operation on test and the destructive command rm -rf /. This effectively bypasses any sandboxing intended by the agent framework because the injection occurs at the level of the compute provider's execution engine. The severity is amplified by the fact that this vulnerability affects multiple deployment modes, allowing for different attack surfaces depending on how the system is configured.
The operational impact varies significantly based on the specific compute provider utilized during the exploitation phase. In configurations where compute="local" is set, the injected commands are executed directly via a subprocess on the host machine running PraisonAI. This poses an extreme risk as it grants the attacker full control over the underlying operating system of the host server, potentially leading to complete system compromise, data exfiltration, or lateral movement within the network infrastructure. In scenarios where Docker is employed as the compute provider, the commands execute within the container environment. While this provides a layer of isolation compared to direct host access, it still allows for significant damage including denial of service through resource exhaustion, reading sensitive configuration files mounted into the container, and potentially escaping the container if other vulnerabilities exist in the runtime or kernel. The ability to execute arbitrary code undermines the fundamental security model of multi-agent systems that rely on isolated execution contexts to prevent malicious agents from harming each other or the host system.
This vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection, due to the failure to properly sanitize user-controllable input before passing it to a shell interpreter. It also maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically reflecting behaviors associated with command execution within automated systems. The root cause is a lack of robust parameterization or safe API usage for file operations that avoids invoking the shell entirely when possible, or at minimum ensures strict whitelisting and escaping of all path components. To mitigate this risk, organizations must immediately upgrade to PraisonAI version 4.6.59 or later where this issue has been patched by implementing proper input validation and secure command construction practices. Until an upgrade is feasible, administrators should restrict the agents' access to file tools, enforce strict allowlists for permitted directories, and avoid using local compute providers with untrusted agent inputs in production environments.