Executive brief
PraisonAI is an AI agent framework that allows LLMs to execute tools like shell commands. A flaw in how the system remembers user approvals allows an agent to run unauthorized commands after a single benign command is approved. This could allow a malicious agent or a prompt injection attack to silently steal sensitive information like API keys and credentials from the system's environment variables.
Technical details
The 'require_approval' decorator in PraisonAI caches tool approval status using only the tool name as a key. Once a user approves a tool like 'execute_command' for a benign action (e.g., 'ls'), the system marks that tool name as approved for the entire execution context. Subsequent calls to the same tool with different, potentially malicious arguments (e.g., 'env' or 'printenv') bypass the approval prompt entirely. This is exacerbated by the framework passing the full process environment to subprocesses via 'os.environ.copy()', enabling secret exfiltration. The issue is fixed in version 1.5.128.
Affected products
- PraisonAI PraisonAI < 1.5.128
- PraisonAI praisonaiagents <= 4.5.124
Timeline
- 2026-04-09: advisory: Original GHSA-ffp3-3562-8cv3 published
- 2026-06-18: disclosed: NVD/VulnCheck publication of CVE-2026-56074
- 2026-06-19: other: Duplicate advisory GHSA-x44p-gg67-52fc published and withdrawn