CVE-2026-57136

In PraisonAI versions 1.2.3 through 1.7.1, the CommandValidator in the TypeScript CLI's sandbox-executor feature checks only the first whitespace-delimited token of a command against the allowedCommands allowlist, while SandboxExecutor passes the complete command string to sh -c. An attacker with limited access to submit commands to the system can begin the string with an allowlisted executable and then append a non-allowlisted command via shell metacharacters, bypassing the sandbox restriction. Successful exploitation results in arbitrary operating-system command execution with the full privileges of the PraisonAI process, impacting confidentiality, integrity, and availability (CVSS 3.1: 8.8, network vector, low privileges required, no user interaction). Anyone using the PraisonAI CLI sandbox-executor on an affected version is impacted; the issue is fixed in version 1.7.2. No public proof of concept is known, the flaw is not on the CISA KEV list, and there is no evidence of in-the-wild exploitation to date.

What to do: Upgrade PraisonAI to version 1.7.2 or later as soon as possible. Audit command logs and history for sandboxed commands where an allowed executable is followed by shell metacharacters (e.g., command chaining or substitution), which would indicate attempted or successful injection. As defense-in-depth, run the PraisonAI process under a least-privileged account and restrict which users, agents, or tool pipelines can submit commands to the sandbox-executor.