EUVD-2026-21152
GHSA-v7px-3835-7gjx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister malicious pre_run_command hook
-
ExploitInject shell metacharacters in command string
-
ExecutionPass unsanitized input to subprocess.run()
-
ImpactExecute arbitrary shell commands with user privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker requires low-privilege local access to the target system running PraisonAIAgents versions prior to 1.5.128. Exploitation occurs via pre_run_command/post_run_command hooks in the hooks configuration or .praisonai/hooks.json lifecycle file, where unsanitized user-controlled command strings are passed to subprocess.run() with shell=True. |
| Impact | High-severity local command injection via shell metacharacter interpretation in subprocess.run(). Authenticated local access required (PR:L). Critical escalation vector: prompt injection enables file-write to .praisonai/hooks.json, executing attacker payloads silently across all lifecycle events without interaction. Impact encompasses confidentiality, integrity, and availability. Priority justified by sustained execution capability post-compromise. |
| Exploit ScenarioDerived | Attacker with local account access injects malicious commands into pre_run_command/post_run_command configuration, or exploits prompt injection to write malicious JSON to .praisonai/hooks.json. Shell metacharacters execute via subprocess.run(shell=True), granting code execution with user privileges at hook lifecycle triggers (BEFORE_TOOL, AFTER_TOOL events). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Command injection in PraisonAIAgents memory hooks executor allows authenticated local attackers to execute arbitrary shell commands through unsanitized user input passed to subprocess.run() with shell=True. Affects versions prior to 1.5.128. Two attack vectors exist: direct exploitation via hook configuration (pre_run_command/post_run_command) and automated exploitation through .praisonai/hooks.json lifecycle hooks (BEFORE_TOOL/AFTER_TOOL). Agent prompt injection enables persistent compromise by overwriting hooks.json, executing payloads silently at every lifecycle event without user interaction. No public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade to PraisonAIAgents version 1.5.128 immediately. This release implements input sanitization for hook command strings and restricts shell metacharacter interpretation. Until patching, disable custom hook functionality entirely by removing or restricting write access to .praisonai/hooks.json configuration file and avoid registering pre_run_command or post_run_command hooks through the hooks API. Review existing .praisonai/hooks.json for unauthorized modifications if agent systems have been exposed to untrusted input. Full technical details available in GitHub Security Advisory: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-v7px-3835-7gjx
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Root cause in praisonaiagents/memory/hooks.py where subprocess.run() invoked with shell=True on unsanitized command strings. CWE-78 OS command injection via shell metacharacter interpretation by /bin/sh. CVSS 4.0 vector shows local attack surface (AV:L) with low privilege requirement (PR:L), achieving complete confidentiality, integrity, availability compromise across vulnerable and subsequent system scope.
Know when Praisonaiagents gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, he memory hooks executor in praisonaiagents passes a user-controlled command string directly to subprocess.run() with shell=True at src/praisonai-agents/praisonaiagents/memory/hooks.py. No sanitization is performed and shell metacharacters are interpreted by /bin/sh before the intended command executes. Two independent attack surfaces exist. The first is via pre_run_command and post_run_command hook event types registered through the hooks configuration. The second and more severe surface is the .praisonai/hooks.json lifecycle configuration, where hooks registered for events such as BEFORE_TOOL and AFTER_TOOL fire automatically during agent operation. An agent that gains file-write access through prompt injection can overwrite .praisonai/hooks.json and have its payload execute silently at every subsequent lifecycle event without further user interaction. This vulnerability is fixed in 1.5.128.
Executive ViewAI
PraisonAIAgents versions before 1.5.128 contain a critical command injection vulnerability in memory hooks that allows authenticated local attackers to execute arbitrary system commands, with persistent compromise possible through agent prompt injection attacks that modify lifecycle hooks. This affects organizations using PraisonAI for autonomous agent deployment, as compromised agents can silently execute malicious commands at every lifecycle event without detection, enabling lateral movement and data exfiltration across connected systems.
Until vendor-released patch is available: (1) Disable or remove all pre_run_command and post_run_command hook configurations in affected agent instances; (2) Restrict local filesystem write permissions on .praisonai/ directories to prevent hooks.json modification by application processes; (3) Implement strict input validation and prompt filtering to prevent agent prompt injection attacks; (4) Monitor subprocess execution logs for unexpected shell command activity originating from PraisonAIAgents processes; (5) Run affected agents in isolated containers with minimal system privileges and no network access to sensitive systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
More in Praisonaiagents
View allSSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Unauthorized filesystem mutation in praisonaiagents allows an LLM-controlled agent to rewrite arbitrary on-disk source f
Unauthenticated tool invocation and potential remote code execution in PraisonAI Agents (praisonaiagents) before 1.6.59,
Unauthenticated remote code execution in the PraisonAI multi-agent framework lets any network-reachable caller run arbit
Unauthenticated remote agent enumeration and invocation in PraisonAI's AgentTeam.launch() / Agents.launch() HTTP server
Arbitrary command and code execution in PraisonAI's workflow engine (versions <4.5.139) and praisonaiagents (<1.5.140) a
Unauthenticated remote session hijacking in PraisonAI's browser bridge (versions <4.5.139) and praisonaiagents (<1.5.140
Server-side request forgery in the SearxNG-backed search tools shipped with the praisonaiagents Python package before 1.
Remote attackers can invoke arbitrary application callables in PraisonAI multi-agent systems by manipulating tool-call n
Arbitrary Python code execution in PraisonAI ≤4.5.138 occurs when malicious tools.py files are automatically imported fr
Exploit-DB