PraisonAI: Compute-bridged file tools allow shell command injection
Affects PraisonAI 4.6.10 through 4.6.57 when a shell-backed compute provider is attached to LocalManagedAgent or SandboxedAgent, bridging the file tools. Fixed in 4.6.59.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 4.6.59
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: no
- Technical impact: total
Summary
PraisonAI, a multi-agent teams system, is affected in versions before 4.6.59 when its file tools (read, list, and write) are used with an attached compute provider. An attacker who can influence a file path argument can inject shell commands that run on the host system or inside the Docker container used for compute.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
PraisonAI is a multi-agent teams system. From version 4.6.10 to before version 4.6.59, LocalManagedAgent / SandboxedAgent compute bridging wraps read_file, list_files, and write_file when a compute provider is attached. The bridge converts those file operations into shell command strings using raw path arguments, then sends those strings to shell-backed compute providers. An attacker who can influence a file-tool path argument can break out of the quoted path and execute arbitrary shell commands in the compute environment. With compute="local", commands execute through the local subprocess compute provider on the host. With Docker, commands execute in the container. This issue has been patched in version 4.6.59.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: poc · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- MervinPraison PraisonAI
From 4.6.10 · fixed in 4.6.59
- praisonaiPyPI
From 4.6.10 · fixed in 4.6.59
References 1
GitHub · MervinPraison/PraisonAI
Questions about CVE-2026-57117
What does this mean?
When a compute provider is attached, PraisonAI's read_file, list_files, and write_file tools build shell command strings from path arguments. A path that breaks out of its quoting can run arbitrary shell commands in the compute environment, which is the host for compute="local" or the container for Docker.Source: github.com
Am I affected, and how do I check?
The suggested affected range is PraisonAI 4.6.10 through 4.6.57. The setup involves LocalManagedAgent or SandboxedAgent with a shell-backed compute provider (local subprocess or Docker) attached, so the file tools are bridged. Check the installed PraisonAI version and whether these agents have a compute provider attached.Source: github.com
What should I do about it?
Upgrade to PraisonAI 4.6.59 or later, the listed fixed version. Until then, remove read_file, list_files, and write_file from compute_bridged_tools, as the advisory's workaround suggests.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.Source: cve.now feed data