CVE-2026-57136 in PraisonAI
Summary
by MITRE • 09/15/2026
PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, CommandValidator in src/praisonai-ts/src/cli/features/sandbox-executor.ts validates only the first whitespace-delimited executable against allowedCommands, then SandboxExecutor passes the complete command string to sh -c. A command beginning with an allowed executable can append a non-allowlisted command through shell metacharacters, causing arbitrary commands to run with the PraisonAI process privileges. This issue is fixed in version 1.7.2.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified within PraisonAI versions ranging from 1.2.3 to 1.7.2 represents a critical command injection flaw rooted in insufficient input validation and improper handling of shell execution contexts. The core issue resides in the CommandValidator component located at src/praisonai-ts/src/cli/features/sandbox-executor.ts, which is responsible for sanitizing user-supplied commands before they are executed within the system's sandboxed environment. During this validation phase, the logic performs a superficial check by parsing the input command string and validating only the first whitespace-delimited token against an allowlist of permitted executables. This approach fails to account for shell metacharacters that can alter the execution flow after the initial executable has been invoked, thereby creating a bypass mechanism for attackers seeking to execute arbitrary commands with the privileges associated with the PraisonAI process.
The operational impact of this flaw is significant because it allows an attacker to circumvent security controls designed to restrict command execution within the sandbox. By crafting a malicious input string that begins with an allowed executable followed by shell metacharacters such as semicolons, pipes, or logical AND operators, an adversary can append additional commands that are not present in the allowlist. For instance, if ls is an allowed command, an attacker could supply ls; rm -rf / to execute a destructive removal operation after listing directory contents. Since the SandboxExecutor subsequently passes this entire un-sanitized string directly to sh -c for execution, the shell interprets these metacharacters as part of its syntax rather than literal data, leading to the unintended and potentially catastrophic execution of arbitrary code. This behavior effectively nullifies the protective boundaries intended by the sandboxing mechanism, exposing the underlying system to unauthorized access, data exfiltration, or denial of service conditions depending on the specific commands injected.
From a technical classification perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. The failure lies not only in the inadequate validation logic but also in the architectural decision to pass raw command strings to a shell interpreter without proper argument separation or escaping mechanisms that would prevent metacharacter interpretation. Furthermore, this attack vector maps directly to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically sub-techniques involving shell commands such as sh/bash (T1059.004). The exploitation relies on the attacker's ability to manipulate command-line arguments to achieve arbitrary code execution, which is a fundamental principle in many post-exploitation frameworks used by threat actors to maintain persistence or escalate privileges within compromised environments.
To mitigate this vulnerability and prevent similar issues in future iterations of PraisonAI, it is essential to implement robust input validation strategies that go beyond simple prefix matching. The CommandValidator should enforce strict allowlisting where the entire command structure, including all arguments and potential metacharacters, is validated against a predefined set of safe patterns or explicitly blocked characters such as semicolons, ampersands, pipes, backticks, and dollar signs. Additionally, avoiding the use of shell interpreters like sh -c for executing user-supplied commands is recommended; instead, direct execution via system calls with explicit argument arrays should be utilized to ensure that arguments are treated strictly as data rather than executable code. Upgrading to version 1.7.2 or later resolves this issue by correcting these validation and execution mechanisms, thereby restoring the integrity of the sandbox environment and ensuring that only explicitly authorized commands can run within the PraisonAI process context.