CVE-2026-57136
Received Received - Intake

Command Injection in PraisonAI Sandbox Executor

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, CommandValidator in src/praisonai-ts/src/cli/features/sandbox-executor.ts validates only the first whitespace-delimited executable against allowedCommands, then SandboxExecutor passes the complete command string to sh -c. A command beginning with an allowed executable can append a non-allowlisted command through shell metacharacters, causing arbitrary commands to run with the PraisonAI process privileges. This issue is fixed in version 1.7.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-57136
EUVD
EUVD-2026-78421

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
praisonai praisonai From 1.2.3 (inc) to 1.7.2 (inc)
mervinpraison praisonai From 1.2.3 (inc) to 1.7.2 (exc)
mervinpraison praisonai 1.7.2
mervinpraison praisonai 4.6.60

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects PraisonAI versions 1.2.3 to 1.7.1. The CommandValidator only checks the first part of a command before a space, allowing attackers to bypass restrictions by adding extra commands using shell metacharacters like semicolons or pipes. The SandboxExecutor then passes the full command to a shell, enabling execution of arbitrary commands with PraisonAI's privileges.

Detection Guidance

Check if PraisonAI versions 1.2.3 to 1.7.1 are installed by running: npm list praisonai or checking package.json. Monitor logs for unexpected command executions or shell metacharacters like semicolons, ampersands, or pipes in commands passed to PraisonAI processes.

Impact Analysis

An attacker could execute arbitrary commands on your system with the same privileges as the PraisonAI process. This may lead to unauthorized file access, data theft, credential misuse, or denial of service attacks, depending on the system configuration and permissions.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, unauthorized disclosures, or integrity violations, potentially leading to regulatory penalties or legal consequences.

Mitigation Strategies

Upgrade PraisonAI to version 1.7.2 or later immediately. Avoid using shell execution methods like spawn with shell:true. Replace with safer alternatives such as spawn(command, args, { shell: false }) or execFile(). Validate commands strictly to reject shell metacharacters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57136. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart