CVE-2026-57133

PraisonAI, an open-source multi-agent framework, ships a shell() helper in its TypeScript tools (src/praisonai-ts/src/tools/utility-tools.ts) that validates only the first whitespace-delimited token of a command string against a 'safeCommands' allowlist, then passes the complete original string to child_process.exec(). In versions 1.5.1 through 1.7.1, an attacker who can influence the command string reaching this helper can start with an allowed read-only command and append a second, non-allowlisted command via shell syntax (for example, chaining through shell metacharacters), resulting in arbitrary command execution with the privileges of the PraisonAI process. Because the tool is invoked by agents that may act on untrusted LLM or user input, deployments that expose the shell() tool to model-driven or user-supplied commands are the most at risk; the CVSS 8.8 vector (AV:N/PR:L) reflects a network-reachable attack path requiring some level of prior access or input control. The flaw is fixed in version 1.7.2. No public proof of concept is known and there is no evidence of in-the-wild exploitation, and the issue is not on the CISA KEV list.

What to do: Upgrade PraisonAI to version 1.7.2 or later, where the allowlist bypass is fixed. Until patched, disable or restrict the shell() tool, and audit any agent workflow where LLM-generated or user-supplied strings can reach it. Run agent processes in a sandboxed container with least privileges and review command logs for allowlisted commands followed by shell metacharacters or chained commands.