Executive brief
PraisonAI, a framework for managing multi-agent AI teams, contains a security flaw that allows for unauthorized remote command execution. By providing a specially crafted input to the system's command-line interface, an attacker can take full control of the underlying server. This could lead to the theft of sensitive data, complete system takeover, or disruption of AI operations.
Technical details
An OS command injection vulnerability exists in PraisonAI's MCPHandler component. The root cause is the lack of sanitization or validation of the `--mcp` command-line argument, which is passed through `shlex.split()` and eventually reaches the `anyio.open_process()` sink. An attacker can exploit this by supplying shell commands (e.g., using `bash -c`) within the `--mcp` argument. This allows for arbitrary code execution with the privileges of the user running the PraisonAI process. The vulnerability is reachable over the network if the CLI arguments are influenced by untrusted input. The issue is resolved in version 4.5.69 by implementing a command allowlist (restricting execution to npx, uvx, node, and python).
Affected products
- MervinPraison PraisonAI >= 4.5.15, < 4.5.69
Timeline
- 2026-03-31: advisory: Original GitHub Security Advisory published
- 2026-04-03: disclosed: CVE published to NVD
- 2026-04-03: patched: Fix released in version 4.5.69