CVE-2026-57133: PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining
PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, the shell() helper exported from src/praisonai-ts/src/tools/utility-tools.ts checks only the first whitespace-delimited token against safeCommands and then passes the complete original string to childprocess.exec(). A string that starts with an allowed read-only command can append a second non-allowlisted command through shell syntax, allowing arbitrary command execution with the PraisonAI process privileges. This issue is fixed in version 1.7.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.7.2
Event History
Frequently Asked Questions
Which deployments are affected?
PraisonAI versions from 1.5.1 through 1.7.2 are identified as affected. The issue is fixed in version 1.7.2.
What access does an attacker need to exploit this issue?
The attacker needs the ability to cause the affected shell() helper to process a command string. They can begin the string with an allowlisted read-only command and use shell chaining to run an additional command.
What is the impact of successful exploitation?
Successful exploitation allows arbitrary command execution with the privileges of the PraisonAI process. This can affect confidentiality, integrity, and availability.
What should be done if an immediate upgrade is not possible?
Restrict untrusted users or inputs from reaching the shell() helper, since exploitation depends on supplying a crafted command string to that helper. Treat command strings beginning with allowlisted commands as unsafe if they can contain shell syntax or appended commands.