CVE-2026-57136: PraisonAI SandboxExecutor allowedCommands bypass via shell chaining
PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, CommandValidator in src/praisonai-ts/src/cli/features/sandbox-executor.ts validates only the first whitespace-delimited executable against allowedCommands, then SandboxExecutor passes the complete command string to sh -c. A command beginning with an allowed executable can append a non-allowlisted command through shell metacharacters, causing arbitrary commands to run with the PraisonAI process privileges. This issue is fixed in version 1.7.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PraisonAI CommandValidator/SandboxExecutorto a version that resolves this vulnerability.Fixed in 1.7.2
Event History
Frequently Asked Questions
Which deployments are affected?
PraisonAI versions from 1.2.3 through 1.7.2 are identified as affected. The issue is fixed in version 1.7.2.
What does an attacker need to exploit this issue?
An attacker needs privileges sufficient to cause SandboxExecutor to run a command. They can begin the command with an executable permitted by allowedCommands and append another command using shell metacharacters.
What is the impact of successful exploitation?
The appended command can run with the privileges of the PraisonAI process. This can result in arbitrary command execution and high impacts to confidentiality, integrity, and availability.
How can I determine whether I am exposed?
Check whether your PraisonAI version falls between 1.2.3 and 1.7.2 and whether SandboxExecutor is used to execute commands subject to allowedCommands validation. Exposure exists when untrusted or insufficiently trusted users can influence those command strings.