Executive brief
PraisonAI, a system for managing multi-agent AI teams, contains a security flaw in its command execution sandbox. The sandbox is intended to restrict the actions AI agents can perform on the underlying computer, but it can be easily bypassed by using common system commands like 'sh' or 'bash'. An attacker or a malicious AI prompt could exploit this to gain full access to the host system, potentially leading to data theft, unauthorized file access, or network compromise.
Technical details
The SubprocessSandbox component in PraisonAI (across BASIC, STRICT, and NETWORK_ISOLATED modes) improperly implements security controls by calling subprocess.run() with shell=True. The system relies on a string-pattern blocklist to prevent dangerous commands, but this list is incomplete and fails to include 'sh' or 'bash' as standalone executables. Furthermore, the regex patterns for piping (e.g., '| sh') require specific spacing that can be easily evaded. An attacker can achieve a sandbox escape by executing commands such as 'sh -c <command>', granting them unauthorized access to the host filesystem and network. This vulnerability is particularly critical when combined with agent prompt injection. The issue is fixed in version 4.5.97 by disabling shell execution and using proper argument splitting.
Affected products
- MervinPraison PraisonAI < 4.5.97
Timeline
- 2026-03-31: advisory: GitHub advisory published by maintainer
- 2026-04-03: disclosed: CVE published to NVD
- 2026-04-04: patched: Fix released in version 4.5.97