MervinPraison PraisonAI unapproved shell command execution in Chainlit UI

Executive brief

PraisonAI is an AI agent framework that can execute tasks and code. A vulnerability in its user interface allows authenticated users to execute arbitrary shell commands on the host server without the required administrator approval. This could lead to full system compromise, data theft, or the deletion of critical files, even if the administrator has explicitly enabled safety prompts.

Technical details

The vulnerability exists in the Chainlit UI modules (chat.py and code.py) of PraisonAI. These modules hardcode 'config.approval_mode = "auto"', which silently overrides the 'PRAISON_APPROVAL_MODE' environment variable set by administrators. This override forces the 'acp_execute_command' function to auto-approve all tool executions. Because the application uses 'subprocess.run(..., shell=True)' with insufficient blocklist-based sanitization, an authenticated user can bypass filters to execute arbitrary single-argument shell commands. This can also be triggered via prompt injection from external content processed by the agent. The issue is fixed in version 4.5.128.

Affected products

• MervinPraison PraisonAI < 4.5.128

Timeline

• 2026-04-09: patched: Version 4.5.128 released
• 2026-04-10: advisory: GitHub Advisory GHSA-qwgj-rrpj-75xm published

References

• https://api.github.com/users/offset
• https://github.com/offset
• https://api.github.com/users/offset/gists%7B/gist_id%7D
• https://api.github.com/users/offset/repos
• https://avatars.githubusercontent.com/u/114768995?v=4
• https://api.github.com/users/offset/events%7B/privacy%7D