PraisonAI: Shell command injection via compute-bridged file tools
Summary
PraisonAI, a multi-agent framework, passes file-tool path arguments into shell command strings when a compute provider is attached to LocalManagedAgent or SandboxedAgent. An attacker who can influence a path argument, for example through prompt injection in content the agent processes, can break out of the quoted path and run arbitrary shell commands. With compute="local" the commands run on the host; with Docker they run inside the container. The attack works even when the operator has not granted the execute_command tool.
Affected
- PraisonAI (praisonai on PyPI) from 4.6.10 up to, but not including, 4.6.59 (the GHSA lists the affected range as up to 4.6.57)
- Affected components: read_file, list_files and write_file when compute bridging is active
Fixed in
- Upgrade to PraisonAI 4.6.59 or later
Workaround
- Unknown. No vendor workaround is documented.
- Interim measure (not from the vendor): remove read_file, list_files and write_file from the compute-bridged tool set, or do not attach a compute provider to affected agents until the upgrade is done.
Exploitation
- CISA SSVC assessment: exploitation status "poc"; automatable "no"; technical impact "total".
- The GHSA advisory contains a local proof-of-concept reproducer.
- No evidence of in-the-wild exploitation was found in the sources reviewed. The exploitation reports found concern a different PraisonAI vulnerability (CVE-2026-44338).
Our recommendation
- Inventory all PraisonAI installations, including lockfiles and container images, and check whether any use LocalManagedAgent or SandboxedAgent with a compute provider.
- Upgrade to PraisonAI 4.6.59 or later.
- Until then, remove file tools from agents that process untrusted input, or disable compute bridging for them.
- Run agents in a tightly scoped container with no host mounts and no secrets to limit the impact of a compromise.
- Review agent logs for unexpected shell-like characters in file paths.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-w6h2-fr4q-xvxv github.com
- OSV: GHSA-w6h2-fr4q-xvxv osv.dev
- OSV: PYSEC-2026-3522 osv.dev
- Vulners: NVD CVE-2026-57117 vulners.com
- Strix: CVE-2026-57117 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:47.
Original description (NVD)
PraisonAI is a multi-agent teams system. From version 4.6.10 to before version 4.6.59, LocalManagedAgent / SandboxedAgent compute bridging wraps read_file, list_files, and write_file when a compute provider is attached. The bridge converts those file operations into shell command strings using raw path arguments, then sends those strings to shell-backed compute providers. An attacker who can influence a file-tool path argument can break out of the quoted path and execute arbitrary shell commands in the compute environment. With compute="local", commands execute through the local subprocess compute provider on the host. With Docker, commands execute in the container. This issue has been patched in version 4.6.59.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.