Executive brief
PraisonAI is an AI agent framework that allows users to interact with Large Language Models (LLMs) to automate tasks. A security flaw in its user interface modules allows authenticated users to bypass safety checks and force the system to execute dangerous shell commands on the underlying server. This could lead to a total system takeover, data theft, or the deletion of critical files, even if an administrator has explicitly configured the system to require manual approval for such actions.
Technical details
An arbitrary shell command execution vulnerability exists in PraisonAI's Chainlit UI modules (chat.py and code.py). The root cause is a hardcoded override where 'config.approval_mode' is set to 'auto', ignoring the 'PRAISON_APPROVAL_MODE' environment variable set by administrators. This bypasses the human-in-the-loop approval gate for tool executions. An authenticated attacker can instruct the LLM agent to execute commands via 'subprocess.run(shell=True)'. While basic blocklists exist for command chaining characters (e.g., ';', '&', '|'), they do not prevent single-command destructive operations like 'rm', 'curl', or 'chmod'. The vulnerability is patched in version 4.5.128.
Affected products
- PraisonAI PraisonAI < 4.5.128
Timeline
- 2026-04-09: advisory: GitHub Security Advisory published
- 2026-06-18: disclosed: NVD publication date