Executive brief
PraisonAI is an npm package that provides AI agent automation tools, including a utility function meant to safely execute read-only shell commands. The vulnerability allows attackers to bypass the command allowlist by chaining unauthorized commands after an allowed command using shell metacharacters (e.g., `echo ok; printf malicious`), enabling arbitrary code execution with PraisonAI process privileges when the helper is exposed to untrusted input sources.
Technical details
The vulnerability is a command injection / authorization bypass in the utility-tools.shell() function. The root cause is a policy/parser differential: the function validates only the first whitespace-delimited token against a hardcoded allowlist (ls, cat, head, tail, wc, grep, find, echo, date, pwd, which), but then executes the entire command string through Node.js child_process.exec(), which runs through a shell. Because the shell parses metacharacters like semicolons, pipes, and redirects, an attacker can bypass the allowlist by prefixing a forbidden command with an allowed one: `echo harmless; malicious-command`. The attack requires network reachability to an application exposing this helper and the ability to influence the command input (via prompts, user tasks, plugin input, or agent-controlled tool output). There is no user interaction required. The patch (version 1.7.2+) replaces exec() with execFile() or spawn() with shell disabled and/or validates the entire parsed command, not just the first token.
Affected products
- Mervin Praison PraisonAI >=1.5.1, <=1.7.1
Timeline
- 2026-06-18: disclosed
- 2026-06-18: patched: Patch released in version 1.7.2