CVE-2026-61434: PraisonAI RCE Vulnerability

CVE-2026-61434 Overview

CVE-2026-61434 is a command injection vulnerability in PraisonAI versions before 4.6.78. The flaw resides in the shell command execution component, where an allowlist filter fails to account for find built-in actions. Attackers with low privileges can abuse the -exec, -execdir, and -delete actions to bypass shell metacharacter filtering. This allows execution of restricted commands, reading of blocked files, deletion of arbitrary files, and invocation of non-allowlisted binaries. The vulnerability is classified under CWE-78 (OS Command Injection).

Critical Impact
Authenticated attackers can bypass command allowlists to achieve arbitrary command execution, file disclosure, and file deletion on hosts running PraisonAI.

Affected Products

PraisonAI versions prior to 4.6.78
Deployments exposing PraisonAI shell command execution features to untrusted input
AI agent workflows relying on PraisonAI's command allowlist as a security boundary

Discovery Timeline

2026-07-10 - CVE-2026-61434 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-61434

Vulnerability Analysis

PraisonAI implements a shell command execution feature that restricts which binaries and metacharacters callers can use. The allowlist blocks common shell metacharacters such as ;, &&, |, and backticks to prevent command chaining. It also restricts which binaries the caller can invoke directly. However, the allowlist permits the find binary, which itself supports built-in actions capable of running arbitrary programs.

The find utility supports -exec <command> {} \;, -execdir <command> {} \;, and -delete. These actions execute or delete files without invoking a shell, so they never pass through shell metacharacter filtering. An attacker can supply a find invocation that runs any binary on the host with the privileges of the PraisonAI process.

Root Cause

The root cause is incomplete allowlist logic. The filter operates on shell syntax rather than on the semantics of permitted binaries. Because find embeds its own execution primitive, allowing find while blocking metacharacters does not constrain what commands ultimately run. This is a classic CWE-78 failure where sanitization does not cover all execution paths.

Attack Vector

An authenticated attacker submits a crafted find command through any PraisonAI interface that invokes the guarded shell executor. For example, find can be directed to a known path with -exec pointing at a non-allowlisted binary, or with -delete targeting sensitive files. Because find performs the execution or deletion directly through the execve family of system calls, no shell interpretation occurs and the metacharacter filter never triggers. The attack requires network access and low privileges but no user interaction. See the GitHub Security Advisory GHSA-cv3g-hj65-pcfh and the VulnCheck Advisory on PraisonAI for further technical details.

Detection Methods for CVE-2026-61434

Indicators of Compromise

Process telemetry showing find invocations that include -exec, -execdir, or -delete arguments originating from the PraisonAI service account
Child processes of the PraisonAI runtime that are not part of the documented allowlist
Unexpected file deletions within directories accessible to the PraisonAI process
Outbound network connections initiated by processes spawned as children of find

Detection Strategies

Monitor command-line arguments of all find executions and alert when -exec, -execdir, or -delete appear in workloads running PraisonAI
Baseline the expected child-process tree of the PraisonAI runtime and flag deviations
Correlate PraisonAI API or prompt inputs containing the string find with subsequent process creation events on the host

Monitoring Recommendations

Enable Linux audit rules (auditd) on execve for the PraisonAI service account to capture full argument vectors
Forward process creation and file deletion events to a centralized log platform for retention and analytics
Track versions of the praisonai package across the estate to identify hosts still running builds prior to 4.6.78

How to Mitigate CVE-2026-61434

Immediate Actions Required

Upgrade PraisonAI to version 4.6.78 or later on all hosts
Restrict network exposure of PraisonAI endpoints to trusted callers until patching is complete
Rotate any secrets or credentials accessible to the PraisonAI process if exploitation is suspected
Review recent PraisonAI audit logs for find invocations containing -exec, -execdir, or -delete

Patch Information

The maintainers addressed the issue in PraisonAI 4.6.78. The fix extends the allowlist logic to reject find invocations that include execution or deletion actions. Details are published in the GitHub Security Advisory GHSA-cv3g-hj65-pcfh.

Workarounds

Remove find from any user-controllable command allowlist until the patched version is deployed
Run PraisonAI under a dedicated low-privilege user account with no write access to sensitive paths
Apply mandatory access controls such as AppArmor or SELinux to constrain the binaries the PraisonAI process may execute
Deploy the service inside a container with a read-only root filesystem and minimal binaries available on PATH

bash

# Configuration example: upgrade PraisonAI and constrain runtime privileges
pip install --upgrade 'praisonai>=4.6.78'

# Run under a dedicated non-privileged user
useradd --system --no-create-home --shell /usr/sbin/nologin praisonai
sudo -u praisonai praisonai serve

# Example auditd rule to log find invocations with dangerous actions
auditctl -a always,exit -F arch=b64 -S execve -F exe=/usr/bin/find -k praisonai_find