MervinPraison PraisonAI SandboxExecutor allowlist bypass via shell chaining

Executive brief

The PraisonAI library for TypeScript contains a security flaw in its command sandbox, which is designed to safely execute AI-generated commands. An attacker can bypass the list of allowed commands by using shell characters like semicolons to chain unauthorized commands after an allowed one. This could allow an attacker to execute arbitrary code on the host system, potentially leading to data theft or full system compromise.

Technical details

The vulnerability exists in the `SandboxExecutor` and `CommandValidator` components of the `praisonai` npm package. The `CommandValidator.validate()` function only checks the first whitespace-delimited token of a command string against the `allowedCommands` list. However, `SandboxExecutor.spawn()` subsequently passes the entire, unvalidated command string to `spawn('sh', ['-c', command])`. This allows an attacker to provide a string like 'echo allowed; unauthorized_command', where the validator only sees 'echo' but the shell executes both. This results in arbitrary command execution with the privileges of the PraisonAI process. The issue is fixed in version 1.7.2.

Affected products

• MervinPraison praisonai >= 1.2.3, <= 1.7.1

Timeline

• 2026-06-17: disclosed
• 2026-06-17: advisory
• 2026-06-18: patched: Version 1.7.2 released

References

• https://api.github.com/users/rexpository
• https://github.com/rexpository
• https://api.github.com/users/rexpository/gists%7B/gist_id%7D
• https://api.github.com/users/rexpository/repos
• https://avatars.githubusercontent.com/u/30176934?v=4
• https://api.github.com/users/rexpository/events%7B/privacy%7D