Executive brief
PraisonAI, an AI agent framework, contains a flaw where its security sandbox fails to enforce configured restrictions. This allows an attacker to bypass "strict" security policies to run unauthorized commands, access sensitive system files, or delete data. Organizations using the default sandbox to run untrusted code are at risk of full system compromise.
Technical details
A vulnerability exists in PraisonAI's Subprocess Sandbox backend (praisonai/sandbox/subprocess.py) where security policy configurations are not enforced. While the 'SecurityPolicy' class defines restrictions for blocked commands, paths, and imports, the default subprocess backend fails to consult these fields before executing code via asyncio.create_subprocess_exec(). An attacker can exploit this to achieve arbitrary command execution, read sensitive files like /etc/passwd, and perform destructive file operations even when 'SecurityPolicy.strict()' is enabled. The issue is resolved in version 4.6.78 by ensuring policy enforcement or using more robust backends like Landlock.
Affected products
- MervinPraison PraisonAI < 4.6.78
Timeline
- 2026-06-25: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: NVD publication date