Executive Summary

The vulnerability exists in PraisonAIAgents, a multi-agent teams system, in versions prior to 1.5.128. The memory hooks executor passes a user-controlled command string directly to subprocess.run() with shell=True without any sanitization. This means shell metacharacters are interpreted by /bin/sh before the command executes.

There are two attack surfaces: one via pre_run_command and post_run_command hook event types configured through hooks, and a more severe one via the .praisonai/hooks.json lifecycle configuration. An attacker who gains file-write access through prompt injection can overwrite this hooks.json file, causing their payload to execute silently at every lifecycle event without further user interaction.

This vulnerability allows arbitrary command execution triggered automatically during agent operation.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed in PraisonAIAgents version 1.5.128. Immediate mitigation involves upgrading to version 1.5.128 or later.

Additionally, restrict file-write access to the .praisonai/hooks.json lifecycle configuration file to prevent unauthorized modification that could lead to silent execution of malicious payloads.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to arbitrary code execution with low privileges but high impact, as malicious commands can be run silently and automatically during agent lifecycle events.

An attacker who exploits this can execute unauthorized commands, potentially leading to data compromise, system manipulation, or further escalation of privileges.

Useful 0 Not Useful 0