CVE-2026-57117: 
PraisonAI vulnerability analysis and mitigation

CVE-2026-57117 is a shell command injection vulnerability in PraisonAI's compute-bridged file tools, specifically within the LocalManagedAgent and SandboxedAgent components. When a compute provider is attached, the _bridge_file_tool() function constructs shell command strings from unsanitized file path arguments for read_file, list_files, and write_file operations, allowing an attacker to inject arbitrary shell commands. It affects praisonai pip package versions >= 4.6.10 and <= 4.6.58, with version 4.6.59 containing the fix. The vulnerability was published on June 17, 2026, with a CVSS v3.1 score of 8.8 (High) (GitHub Advisory, GitHub Advisory DB).

The root cause is CWE-78 (OS Command Injection) with a secondary weakness of CWE-863 (Incorrect Authorization). In src/praisonai/praisonai/integrations/managed_local.py, the _bridge_file_tool() method constructs shell strings by directly interpolating user-controlled path arguments into f-strings such as f'cat "{filepath}"', f'ls -la "{directory}"', and a heredoc form for write_file. These strings are then executed via asyncio.create_subprocess_shell(...) (local provider) or ["sh", "-c", command] (Docker provider). An attacker supplying a path like missing"; printf "$ENV_VAR"; # causes the shell to interpret the injected commands, bypassing the tool-approval registry which marks execute_command as critical but treats read_file and list_files as non-dangerous. A public proof-of-concept reproducer is included in the advisory (GitHub Advisory).

Successful exploitation allows an attacker with low-privilege access to an agent interface to execute arbitrary shell commands on the host system (with compute="local") or within a Docker container, bypassing least-privilege tool configurations and tool-approval controls. The impact covers full confidentiality, integrity, and availability compromise of the compute environment — including unauthorized data access, file modification or deletion, and potential for further lateral movement within the host or container network. This is particularly severe in deployments that expose PraisonAI agents via chat endpoints, automation webhooks, or prompt-injection-susceptible pipelines without authentication, where the effective privilege requirement may be none (GitHub Advisory, GitHub Advisory DB).

1. Reconnaissance: Identify a deployment of PraisonAI using LocalManagedAgent or SandboxedAgent with a compute provider (compute="local" or Docker) and file tools (read_file, list_files, or write_file) enabled, running versions >= 4.6.10 and <= 4.6.58.
2. Access the agent interface: Obtain low-privilege access to the agent via a chat endpoint, automation webhook, prompt-injection vector, or other user-controlled task submission mechanism.
3. Craft a malicious path payload: Construct a file path argument containing shell metacharacters to break out of the quoted string context, e.g., missing"; <malicious_command>; # — the closing quote terminates the intended argument, the semicolon introduces a new command, and the # comments out the trailing quote.
4. Submit the payload: Invoke read_file or list_files with the crafted path through the agent interface (e.g., via a prompt instructing the agent to read a specific file path).
5. Shell command execution: The _bridge_file_tool() method constructs a shell string such as cat "missing"; <malicious_command>; #" and passes it to asyncio.create_subprocess_shell() or sh -c, executing the injected command in the compute environment.
6. Achieve objective: Retrieve command output (e.g., environment variables, file contents, network information), establish persistence, exfiltrate data, or pivot within the host or container network (GitHub Advisory).

• Logs: Subprocess execution logs showing shell commands spawned from the PraisonAI process with arguments containing shell metacharacters (", ;, $(), backticks, #) in what appear to be file path positions; unexpected command output returned through agent file-tool responses.
• Process: Unusual child processes spawned by the PraisonAI Python process (e.g., sh, bash, curl, wget, nc, python) with arguments not consistent with normal file read/list operations; processes executing with the PraisonAI service account identity performing network connections or file writes outside the working directory.
• Network: Unexpected outbound connections from the PraisonAI host or Docker container to external IPs, particularly following agent file-tool invocations; DNS lookups for unfamiliar domains originating from the compute environment.
• File System: New or modified files in the PraisonAI working directory or system directories not attributable to normal agent operations; unexpected cron jobs, scheduled tasks, or startup scripts created under the service account (GitHub Advisory).

Upgrade the praisonai pip package to version 4.6.59 or later, which contains the patch for this vulnerability. As an immediate stopgap, remove read_file, list_files, and write_file from the compute_bridged_tools set in managed_local.py until provider-native file APIs are implemented. The preferred long-term fix is to replace shell-string construction with provider-native file APIs or structured argv invocations that do not pass path data through shell interpretation. Additionally, restrict agent interfaces to authenticated users and apply network-level controls to limit outbound connections from compute environments (GitHub Advisory, GitHub Advisory DB).

The vulnerability was reported by security researcher rexpository and published by the maintainer MervinPraison on June 17, 2026, with the GitHub Advisory Database review completed on June 18, 2026. No broader media coverage, notable researcher commentary beyond the advisory, or significant social media discussion has been identified at this time (GitHub Advisory).