CVE-2026-40111

PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, he memory hooks executor in praisonaiagents passes a user-controlled command string directly to subprocess.run() with shell=True at src/praisonai-agents/praisonaiagents/memory/hooks.py. No sanitization is performed and shell metacharacters are interpreted by /bin/sh before the intended command executes. Two independent attack surfaces exist. The first is via pre_run_command and post_run_command hook event types registered through the hooks configuration. The second and more severe surface is the .praisonai/hooks.json lifecycle configuration, where hooks registered for events such as BEFORE_TOOL and AFTER_TOOL fire automatically during agent operation. An agent that gains file-write access through prompt injection can overwrite .praisonai/hooks.json and have its payload execute silently at every subsequent lifecycle event without further user interaction. This vulnerability is fixed in 1.5.128.

PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, he memory hooks executor in praisonaiagents passes a user-controlled command string directly to subprocess.run() with shell=True at src/praisonai-agents/praisonaiagents/memory/hooks.py. No sanitization is performed and shell metacharacters are interpreted by /bin/sh before the intended command executes. Two independent attack surfaces exist. The first is via pre_run_command and post_run_command hook event types registered through the hooks configuration. The second and more severe surface is the .praisonai/hooks.json lifecycle configuration, where hooks registered for events such as BEFORE_TOOL and AFTER_TOOL fire automatically during agent operation. An agent that gains file-write access through prompt injection can overwrite .praisonai/hooks.json and have its payload execute silently at every subsequent lifecycle event without further user interaction. This vulnerability is fixed in 1.5.128.

Summary

The memory hooks executor in praisonaiagents passes a user-controlled command string directly to subprocess.run() with shell=True at src/praisonai-agents/praisonaiagents/memory/hooks.py lines 303 to 305. No sanitization, no shlex.quote(), no character filter, and no allowlist check exists anywhere in this file. Shell metacharacters including semicolons, pipes, ampersands, backticks, dollar-sign substitutions, and newlines are interpreted by /bin/sh before the intended command executes.

Two independent attack surfaces exist. The first is via pre_run_command and post_run_command hook event types registered through the hooks configuration. The second and more severe surface is the .praisonai/hooks.json lifecycle configuration, where hooks registered for events such as BEFORE_TOOL and AFTER_TOOL fire automatically during agent operation. An agent that gains file-write access through prompt injection can overwrite .praisonai/hooks.json and have its payload execute silently at every subsequent lifecycle event without further user interaction.

This file and these surfaces are not covered by any existing published advisory.

Vulnerability Description

File : src/praisonai-agents/praisonaiagents/memory/hooks.py Lines : 303 to 305

Vulnerable code:

result = subprocess.run(
    command,
    shell=True,
    cwd=str(self.workspace_path),
    env=env,
    capture_output=True,
    text=True,
    timeout=hook.timeout
)

The variable command originates from hook.command, which is loaded directly from .praisonai/hooks.json at line 396 of the same file.

The hooks system registers pre_run_command and post_run_command as event types at lines 54 and 55 and dispatches them through _execute_script() at line 261, which calls the subprocess.run() block above.

HookRunner at hooks/runner.py line 210 routes command-type hooks through _execute_command_hook(), which feeds into this executor.

BEFORE_TOOL and AFTER_TOOL events are fired automatically at every tool call from agent/tool_execution.py line 183 and agent/chat_mixin.py line 2052.

No fix exists. shell=False does not appear anywhere in memory/hooks.py.

Grep Commands and Confirmed Output

Step 1. Confirm shell=True at exact line

grep -n "shell=True" \
  src/praisonai-agents/praisonaiagents/memory/hooks.py

Confirmed output:
305:                shell=True,

Step 2. Confirm subprocess imported and called

grep -n "import subprocess\|subprocess\.run\|subprocess\.Popen" \
  src/praisonai-agents/praisonaiagents/memory/hooks.py

Confirmed output:
41:import subprocess
303:            result = subprocess.run(

Step 3. View full vulnerable call with context

sed -n '295,320p' \
  src/praisonai-agents/praisonaiagents/memory/hooks.py

Confirmed output:
        result = subprocess.run(
            command,
            shell=True,
            cwd=str(self.workspace_path),
            env=env,
            capture_output=True,
            text=True,
            timeout=hook.timeout
        )

Step 4. Confirm zero sanitization in this file

grep -n "shlex\|quote\|sanitize\|allowlist\|banned_chars\|strip\|validate" \
  src/praisonai-agents/praisonaiagents/memory/hooks.py

Confirmed output:
(no output)

Step 5. Confirm hooks.json load and lifecycle dispatch

grep -rn "hooks\.json\|BEFORE_TOOL\|AFTER_TOOL\|hook.*execut\|execut.*hook" \
  src/praisonai-agents/praisonaiagents/ \
  --include="*.py"

Confirmed output (key lines):
memory/hooks.py:105:   CONFIG_FILE = f"{_DIR_NAME}/hooks.json"
memory/hooks.py:396:   config_path = config_dir / "hooks.json"
agent/tool_execution.py:183:   self._hook_runner.execute_sync(HookEvent.BEFORE_TOOL, ...)
agent/chat_mixin.py:2052:      await self._hook_runner.execute(HookEvent.BEFORE_TOOL, ...)
hooks/runner.py:210:           return await self._execute_command_hook(...)

Step 6. Confirm…

PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, he memory hooks executor in praisonaiagents passes a user-controlled command string directly to subprocess.run() with shell=True at src/praisonai-agents/praisonaiagents/memory/hooks.py. No sanitization is performed and shell metacharacters are interpreted by /bin/sh before the intended command executes. Two independent attack surfaces exist. The first is via pre_run_command and post_run_command hook event types registered through the hooks configuration. The second and more severe surface is the .praisonai/hooks.json lifecycle configuration, where hooks registered for events such as BEFORE_TOOL and AFTER_TOOL fire automatically during agent operation. An agent that gains file-write access through prompt injection can overwrite .praisonai/hooks.json and have its payload execute silently at every subsequent lifecycle event without further user interaction. This vulnerability is fixed in 1.5.128.

Summary

The memory hooks executor in praisonaiagents passes a user-controlled command string directly to subprocess.run() with shell=True at src/praisonai-agents/praisonaiagents/memory/hooks.py lines 303 to 305. No sanitization, no shlex.quote(), no character filter, and no allowlist check exists anywhere in this file. Shell metacharacters including semicolons, pipes, ampersands, backticks, dollar-sign substitutions, and newlines are interpreted by /bin/sh before the intended command executes.

Two independent attack surfaces exist. The first is via pre_run_command and post_run_command hook event types registered through the hooks configuration. The second and more severe surface is the .praisonai/hooks.json lifecycle configuration, where hooks registered for events such as BEFORE_TOOL and AFTER_TOOL fire automatically during agent operation. An agent that gains file-write access through prompt injection can overwrite .praisonai/hooks.json and have its payload execute silently at every subsequent lifecycle event without further user interaction.

This file and these surfaces are not covered by any existing published advisory.

Vulnerability Description

File : src/praisonai-agents/praisonaiagents/memory/hooks.py Lines : 303 to 305

Vulnerable code:

result = subprocess.run(
    command,
    shell=True,
    cwd=str(self.workspace_path),
    env=env,
    capture_output=True,
    text=True,
    timeout=hook.timeout
)

The variable command originates from hook.command, which is loaded directly from .praisonai/hooks.json at line 396 of the same file.

The hooks system registers pre_run_command and post_run_command as event types at lines 54 and 55 and dispatches them through _execute_script() at line 261, which calls the subprocess.run() block above.

HookRunner at hooks/runner.py line 210 routes command-type hooks through _execute_command_hook(), which feeds into this executor.

BEFORE_TOOL and AFTER_TOOL events are fired automatically at every tool call from agent/tool_execution.py line 183 and agent/chat_mixin.py line 2052.

No fix exists. shell=False does not appear anywhere in memory/hooks.py.

Grep Commands and Confirmed Output

Step 1. Confirm shell=True at exact line

grep -n "shell=True" \
  src/praisonai-agents/praisonaiagents/memory/hooks.py

Confirmed output:
305:                shell=True,

Step 2. Confirm subprocess imported and called

grep -n "import subprocess\|subprocess\.run\|subprocess\.Popen" \
  src/praisonai-agents/praisonaiagents/memory/hooks.py

Confirmed output:
41:import subprocess
303:            result = subprocess.run(

Step 3. View full vulnerable call with context

sed -n '295,320p' \
  src/praisonai-agents/praisonaiagents/memory/hooks.py

Confirmed output:
        result = subprocess.run(
            command,
            shell=True,
            cwd=str(self.workspace_path),
            env=env,
            capture_output=True,
            text=True,
            timeout=hook.timeout
        )

Step 4. Confirm zero sanitization in this file

grep -n "shlex\|quote\|sanitize\|allowlist\|banned_chars\|strip\|validate" \
  src/praisonai-agents/praisonaiagents/memory/hooks.py

Confirmed output:
(no output)

Step 5. Confirm hooks.json load and lifecycle dispatch

grep -rn "hooks\.json\|BEFORE_TOOL\|AFTER_TOOL\|hook.*execut\|execut.*hook" \
  src/praisonai-agents/praisonaiagents/ \
  --include="*.py"

Confirmed output (key lines):
memory/hooks.py:105:   CONFIG_FILE = f"{_DIR_NAME}/hooks.json"
memory/hooks.py:396:   config_path = config_dir / "hooks.json"
agent/tool_execution.py:183:   self._hook_runner.execute_sync(HookEvent.BEFORE_TOOL, ...)
agent/chat_mixin.py:2052:      await self._hook_runner.execute(HookEvent.BEFORE_TOOL, ...)
hooks/runner.py:210:           return await self._execute_command_hook(...)

Step 6. Confirm…

Summary

The memory hooks executor in praisonaiagents passes a user-controlled command string directly to subprocess.run() with shell=True at src/praisonai-agents/praisonaiagents/memory/hooks.py lines 303 to 305. No sanitization, no shlex.quote(), no character filter, and no allowlist check exists anywhere in this file. Shell metacharacters including semicolons, pipes, ampersands, backticks, dollar-sign substitutions, and newlines are interpreted by /bin/sh before the intended command executes.

Two independent attack surfaces exist. The first is via pre_run_command and post_run_command hook event types registered through the hooks configuration. The second and more severe surface is the .praisonai/hooks.json lifecycle configuration, where hooks registered for events such as BEFORE_TOOL and AFTER_TOOL fire automatically during agent operation. An agent that gains file-write access through prompt injection can overwrite .praisonai/hooks.json and have its payload execute silently at every subsequent lifecycle event without further user interaction.

This file and these surfaces are not covered by any existing published advisory.

Vulnerability Description

File : src/praisonai-agents/praisonaiagents/memory/hooks.py Lines : 303 to 305

Vulnerable code:

result = subprocess.run(
    command,
    shell=True,
    cwd=str(self.workspace_path),
    env=env,
    capture_output=True,
    text=True,
    timeout=hook.timeout
)

The variable command originates from hook.command, which is loaded directly from .praisonai/hooks.json at line 396 of the same file.

The hooks system registers pre_run_command and post_run_command as event types at lines 54 and 55 and dispatches them through _execute_script() at line 261, which calls the subprocess.run() block above.

HookRunner at hooks/runner.py line 210 routes command-type hooks through _execute_command_hook(), which feeds into this executor.

BEFORE_TOOL and AFTER_TOOL events are fired automatically at every tool call from agent/tool_execution.py line 183 and agent/chat_mixin.py line 2052.

No fix exists. shell=False does not appear anywhere in memory/hooks.py.

Grep Commands and Confirmed Output

Step 1. Confirm shell=True at exact line

grep -n "shell=True" \
  src/praisonai-agents/praisonaiagents/memory/hooks.py

Confirmed output:
305:                shell=True,

Step 2. Confirm subprocess imported and called

grep -n "import subprocess\|subprocess\.run\|subprocess\.Popen" \
  src/praisonai-agents/praisonaiagents/memory/hooks.py

Confirmed output:
41:import subprocess
303:            result = subprocess.run(

Step 3. View full vulnerable call with context

sed -n '295,320p' \
  src/praisonai-agents/praisonaiagents/memory/hooks.py

Confirmed output:
        result = subprocess.run(
            command,
            shell=True,
            cwd=str(self.workspace_path),
            env=env,
            capture_output=True,
            text=True,
            timeout=hook.timeout
        )

Step 4. Confirm zero sanitization in this file

grep -n "shlex\|quote\|sanitize\|allowlist\|banned_chars\|strip\|validate" \
  src/praisonai-agents/praisonaiagents/memory/hooks.py

Confirmed output:
(no output)

Step 5. Confirm hooks.json load and lifecycle dispatch

grep -rn "hooks\.json\|BEFORE_TOOL\|AFTER_TOOL\|hook.*execut\|execut.*hook" \
  src/praisonai-agents/praisonaiagents/ \
  --include="*.py"

Confirmed output (key lines):
memory/hooks.py:105:   CONFIG_FILE = f"{_DIR_NAME}/hooks.json"
memory/hooks.py:396:   config_path = config_dir / "hooks.json"
agent/tool_execution.py:183:   self._hook_runner.execute_sync(HookEvent.BEFORE_TOOL, ...)
agent/chat_mixin.py:2052:      await self._hook_runner.execute(HookEvent.BEFORE_TOOL, ...)
hooks/runner.py:210:           return await self._execute_command_hook(...)

Step 6. Confirm…