CVE-2026-57117: PraisonAI: Compute-bridged file tools allow shell command injection
PraisonAI is a multi-agent teams system. From version 4.6.10 to before version 4.6.59, LocalManagedAgent / SandboxedAgent compute bridging wraps readfile, listfiles, and writefile when a compute provider is attached. The bridge converts those file operations into shell command strings using raw path arguments, then sends those strings to shell-backed compute providers. An attacker who can influence a file-tool path argument can break out of the quoted path and execute arbitrary shell commands in the compute environment. With compute="local", commands execute through the local subprocess compute provider on the host. With Docker, commands execute in the container. This issue has been patched in version 4.6.59.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PraisonAIto a version that resolves this vulnerability.Fixed in 4.6.59
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
PraisonAI versions 4.6.10 through 4.6.58 are affected when LocalManagedAgent or SandboxedAgent has a compute provider attached and uses the bridged read_file, list_files, or write_file tools. The impact depends on the compute provider: local compute runs commands on the host, while Docker compute runs them in the container.
What access does an attacker need to exploit it?
An attacker must be able to influence a path argument passed to one of the affected file tools. The vulnerable bridge places raw path arguments into shell command strings, allowing a crafted path to escape quoting and execute commands in the compute environment.
What should teams do if they cannot immediately upgrade?
Avoid attaching shell-backed compute providers to affected LocalManagedAgent or SandboxedAgent instances, or prevent untrusted input from reaching file-tool path arguments. Upgrading to PraisonAI 4.6.59 resolves the issue.
How can I determine the likely execution scope?
Check the configured compute provider for affected agents. With compute="local", injected commands execute through the local subprocess provider on the host; with Docker, they execute in the container.