Description
PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI modules hardcode approval_mode to auto, overriding administrator configuration from PRAISON_APPROVAL_MODE environment variable. Authenticated attackers can instruct the LLM agent to execute arbitrary shell commands via subprocess.run with shell=True, bypassing the manual approval gate and insufficient command sanitization blocklists.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| PraisonAI | PraisonAI | < 4.5.128 | 4.5.128 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | praisonai | < 4.5.128 | 4.5.128 | GHSA-qwgj-rrpj-75xm |
References
- GitHub Security Advisory (GHSA-qwgj-rrpj-75xm) vendor-advisory
- VulnCheck Advisory: PraisonAI - Arbitrary Shell Command Execution via Hardcoded Approval Mode Override third-party-advisory