EUVD-2026-21176
GHSA-v8g7-9q6v-p3x8
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionGitHub Advisory
PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, the execute_command function in shell_tools.py calls os.path.expandvars() on every command argument at line 64, manually re-implementing shell-level environment variable expansion despite using shell=False (line 88) for security. This allows exfiltration of secrets stored in environment variables (database credentials, API keys, cloud access keys). The approval system displays the unexpanded $VAR references to human reviewers, creating a deceptive approval where the displayed command differs from what actually executes. This vulnerability is fixed in 1.5.128.
AnalysisAI
Environment variable exfiltration in PraisonAIAgents versions prior to 1.5.128 allows unauthenticated remote attackers to steal secrets (database credentials, API keys, cloud access keys) through shell_tools.py execute_command function. The vulnerability leverages deceptive command approval where unexpanded $VAR references shown to human reviewers differ from executed commands containing expanded environment variable values. Requires user interaction. No public exploit identified at time of analysis.
Technical ContextAI
The execute_command function improperly implements manual environment variable expansion via os.path.expandvars() on command arguments despite using shell=False. This CWE-526 information exposure creates an approval bypass: users approve commands displaying literal $VAR syntax while subprocess.run() executes commands with fully expanded sensitive environment variable contents, enabling cross-site confidentiality impact without command injection.
RemediationAI
Vendor-released patch: upgrade PraisonAIAgents to version 1.5.128 immediately. This release removes os.path.expandvars() manual expansion from shell_tools.py execute_command function, preventing environment variable exfiltration while maintaining shell=False subprocess security posture. Organizations using multi-agent systems must audit command approval workflows for similar deceptive expansion patterns. Rotate all API keys, database credentials, and cloud access tokens potentially exposed through environment variables in affected deployments. Review execution logs for suspicious $VAR patterns in historical command arguments. Official advisory: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-v8g7-9q6v-p3x8
More in Praisonaiagents
View allSSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Unauthorized filesystem mutation in praisonaiagents allows an LLM-controlled agent to rewrite arbitrary on-disk source f
Command injection in PraisonAIAgents memory hooks executor allows authenticated local attackers to execute arbitrary she
Unauthenticated remote session hijacking in PraisonAI's browser bridge (versions <4.5.139) and praisonaiagents (<1.5.140
Remote attackers can invoke arbitrary application callables in PraisonAI multi-agent systems by manipulating tool-call n
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Server-side request forgery in PraisonAIAgents multi-agent system allows authenticated attackers to force internal netwo
Server-Side Request Forgery (SSRF) in PraisonAIAgents versions prior to 1.5.128 allows unauthenticated attackers to mani
PraisonAIAgents versions prior to 1.5.128 allow unauthenticated local attackers to read arbitrary files from the filesys
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today