Executive brief
PraisonAI, a framework for AI agents, contains a security flaw in how it handles user permission for running system commands. When a user approves a single safe command (like listing files), the system mistakenly remembers that approval for all future commands in that session. This allows an AI agent—potentially manipulated by a malicious prompt—to silently run dangerous commands to steal sensitive data like API keys and passwords without the user's knowledge.
Technical details
The vulnerability exists in the 'require_approval' decorator within the PraisonAI Agents approval system. The system caches approval status using only the tool name (e.g., 'execute_command') as the key, failing to include the specific invocation arguments in the cache lookup. Consequently, once a user provides manual consent for a benign command, all subsequent calls to that tool are automatically authorized for the remainder of the execution context. An attacker can leverage this via prompt injection to first request a harmless command and then silently execute shell commands to exfiltrate process environment variables (such as OPENAI_API_KEY) which are passed to subprocesses via 'os.environ.copy()'. The issue is addressed in version 1.5.128.
Affected products
- MervinPraison PraisonAI (praisonaiagents) < 1.5.128
Timeline
- 2026-04-09: advisory: GitHub Security Advisory published
- 2026-06-18: disclosed: NVD publication date