CVE-2026-57133: PraisonAI Command Injection RCE Vulnerability

CVE-2026-57133 Overview

CVE-2026-57133 is a command injection vulnerability [CWE-78] in PraisonAI, a multi-agent teams system. The shell() helper exported from src/praisonai-ts/src/tools/utility-tools.ts validates only the first whitespace-delimited token against an allowlist of safe commands. It then passes the full original string to child_process.exec(). Attackers can prepend an allowlisted read-only command and append arbitrary commands using shell metacharacters. The flaw affects versions 1.5.1 through 1.7.1 and is fixed in version 1.7.2.

Critical Impact
Authenticated attackers can execute arbitrary operating system commands with the privileges of the PraisonAI process, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

PraisonAI versions 1.5.1 through 1.7.1
praisonai-ts package (src/praisonai-ts/src/tools/utility-tools.ts)
Multi-agent deployments exposing the shell() tool to agent workflows

Discovery Timeline

2026-09-15 - CVE-2026-57133 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-57133

Vulnerability Analysis

The shell() helper in PraisonAI enforces an allowlist by inspecting only the first token of the supplied command string. After the check passes, the helper forwards the untouched string to Node.js child_process.exec(), which spawns a shell to interpret the input. Because the shell honors metacharacters such as ;, |, &, backticks, and $(), an attacker can chain additional commands after any allowlisted binary. The result is arbitrary command execution under the PraisonAI process account. Any agent, plugin, or upstream input source able to call the shell() tool can trigger the flaw.

Root Cause

The allowlist logic parses input.split(/\s+/)[0] and compares it to safeCommands, but never re-serializes or sanitizes the remainder. The complete original string, including shell metacharacters, is passed to exec(). This produces a classic OS Command Injection pattern where validation and execution operate on different representations of the input.

Attack Vector

An attacker with the ability to influence agent tool inputs supplies a payload beginning with an allowlisted command such as ls, cat, or echo, then appends a chained command using ; or &&. Because the network attack vector requires only low privileges and no user interaction, exploitation is straightforward wherever agent inputs are reachable from untrusted sources such as prompts, retrieval documents, or web-facing agent APIs.

typescript

// Patch excerpt: sandbox-executor.ts metacharacter pattern fix
// Shell metacharacters that enable command chaining or substitution
export const SHELL_METACHAR_PATTERN = /[;|&`><]|\$\([^)]*\)|\$\{/;

// Commands that typically require network access
export const NETWORK_COMMANDS = [
  // ...
];
// Source: https://github.com/MervinPraison/PraisonAI/commit/6b4b59fbe71a74983626c7a0cf7e10c47cd004f9

The patch corrects a broken regular expression so shell metacharacter detection functions as intended, blocking chained payloads before execution.

Detection Methods for CVE-2026-57133

Indicators of Compromise

Process creation events showing the Node.js PraisonAI process spawning /bin/sh -c with chained commands containing ;, &&, |, or $().
Unexpected child processes such as curl, wget, nc, bash, or python descending from the PraisonAI runtime.
Outbound network connections from the PraisonAI host to unfamiliar IPs immediately following agent tool invocations.

Detection Strategies

Instrument the shell() tool call path to log the full command string, argument count, and caller context for offline review.
Alert on process trees where PraisonAI is the parent of interpreters or network utilities not required by the workload.
Correlate agent prompt logs with shell execution telemetry to flag inputs containing shell metacharacters.

Monitoring Recommendations

Enable command-line auditing on hosts running PraisonAI and forward events to a centralized analytics platform.
Monitor for anomalous file writes, credential access, or SSH key enumeration originating from the PraisonAI service account.
Track version metadata of deployed praisonai-ts packages to detect drift from the patched release.

How to Mitigate CVE-2026-57133

Immediate Actions Required

Upgrade PraisonAI to version 1.7.2 or later across all environments.
Audit agent configurations to identify any workflow that exposes the shell() tool to untrusted input.
Rotate credentials, tokens, and keys accessible from any host that ran a vulnerable version.

Patch Information

The fix is available in PraisonAI 1.7.2. See the GitHub Security Advisory GHSA-5jv7-2mjm-h6qj, the remediation commit, and the PraisonAI release notes for details.

Workarounds

Disable the shell() utility tool in agent configurations until upgrade is possible.
Run PraisonAI as a low-privilege user inside a container or sandbox that restricts filesystem and network access.
Wrap tool inputs with a strict validator that rejects any string containing shell metacharacters before dispatch.

bash

# Upgrade to the patched version
npm install praisonai@1.7.2

# Verify installed version
npm list praisonai