Executive brief
PraisonAI, an AI agent framework, is vulnerable to a security flaw that allows attackers to execute unauthorized commands on the underlying system. By providing malicious input through workflow files, agent configurations, or even manipulated AI prompts, an attacker can gain full control over the environment where the software is running. This could lead to the theft of sensitive data, such as SSH keys and passwords, or the complete disruption of business operations.
Technical details
PraisonAI's workflow system and command execution tools (specifically the `execute_command` function and `_exec_shell` method) pass user-controlled input directly to `subprocess.run()` with `shell=True`. This configuration allows the shell to interpret metacharacters such as `;`, `|`, and `&&`. Attackers can exploit this by supplying malicious strings in YAML workflow steps, `agents.yaml` task descriptions, or via prompt injection that influences LLM-generated tool parameters. Successful exploitation results in arbitrary code execution (RCE) with the privileges of the application process. The vulnerability is addressed in version 4.5.121 by disabling shell execution by default and improving input validation.
Affected products
- MervinPraison PraisonAI < 4.5.121
Timeline
- 2026-04-08: disclosed
- 2026-04-08: patched: Fixed in version 4.5.121
- 2026-04-08: advisory