EUVD-2026-21176
GHSA-v8g7-9q6v-p3x8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft command with environment variable references
-
DeliverySubmit to approval system
-
ExploitReviewer approves unexpanded $VAR syntax
-
Executionexecute_command expands variables
-
ImpactExfiltrate secrets in environment
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A02:2025 - Security Misconfiguration
ASVS 5.0
V13 - Configuration Environment variable protection
|
| Exploitation Conditions | The victim must be a human reviewer in PraisonAIAgents (prior to 1.5.128) who approves a crafted command containing $VAR environment variable references. The approval UI displays unexpanded variables, but execute_command expands them at runtime, exfiltrating secrets like database credentials and API keys stored in environment variables. |
| Impact | Network-exploitable without authentication; requires user interaction (UI:R) to approve deceptive commands. High confidentiality impact via environment variable exfiltration of credentials and API keys. Elevated observed exploitation activity suggests real-world targeting. Moderate blast radius constrained by UI requirement and targeted application scope, but secrets exposure creates downstream compromise risk. |
| Exploit ScenarioDerived | Attacker crafts PraisonAIAgents prompt containing obfuscated $VAR references (e.g., |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Environment variable exfiltration in PraisonAIAgents versions prior to 1.5.128 allows unauthenticated remote attackers to steal secrets (database credentials, API keys, cloud access keys) through shell_tools.py execute_command function. The vulnerability leverages deceptive command approval where unexpanded $VAR references shown to human reviewers differ from executed commands containing expanded environment variable values. Requires user interaction. No public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade PraisonAIAgents to version 1.5.128 immediately. This release removes os.path.expandvars() manual expansion from shell_tools.py execute_command function, preventing environment variable exfiltration while maintaining shell=False subprocess security posture. Organizations using multi-agent systems must audit command approval workflows for similar deceptive expansion patterns. Rotate all API keys, database credentials, and cloud access tokens potentially exposed through environment variables in affected deployments. Review execution logs for suspicious $VAR patterns in historical command arguments. Official advisory: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-v8g7-9q6v-p3x8
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The execute_command function improperly implements manual environment variable expansion via os.path.expandvars() on command arguments despite using shell=False. This CWE-526 information exposure creates an approval bypass: users approve commands displaying literal $VAR syntax while subprocess.run() executes commands with fully expanded sensitive environment variable contents, enabling cross-site confidentiality impact without command injection.
Know when Praisonaiagents gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, the execute_command function in shell_tools.py calls os.path.expandvars() on every command argument at line 64, manually re-implementing shell-level environment variable expansion despite using shell=False (line 88) for security. This allows exfiltration of secrets stored in environment variables (database credentials, API keys, cloud access keys). The approval system displays the unexpanded $VAR references to human reviewers, creating a deceptive approval where the displayed command differs from what actually executes. This vulnerability is fixed in 1.5.128.
Executive ViewAI
PraisonAIAgents versions below 1.5.128 contain a critical secret exfiltration vulnerability where environment variables containing sensitive credentials (API keys, database passwords, cloud access tokens) can be stolen by unauthenticated attackers through deceptive command approval mechanisms. This directly threatens organizations using this agent framework, as legitimate-appearing commands hide actual environment variable expansion, putting production credentials at immediate risk of compromise.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable or restrict execute_command functionality in shell_tools.py if operationally feasible; (2) Run PraisonAIAgents with minimal environment variable exposure and implement principle of least privilege for process permissions; (3) Implement network segmentation to limit lateral movement if credentials are exfiltrated; (4) Enforce command approval workflows that display fully expanded commands with variable values before execution; (5) Monitor and log all shell_tools.py command execution attempts and environment variable access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Praisonaiagents
View allSSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Unauthorized filesystem mutation in praisonaiagents allows an LLM-controlled agent to rewrite arbitrary on-disk source f
Unauthenticated tool invocation and potential remote code execution in PraisonAI Agents (praisonaiagents) before 1.6.59,
Unauthenticated remote code execution in the PraisonAI multi-agent framework lets any network-reachable caller run arbit
Unauthenticated remote agent enumeration and invocation in PraisonAI's AgentTeam.launch() / Agents.launch() HTTP server
Arbitrary command and code execution in PraisonAI's workflow engine (versions <4.5.139) and praisonaiagents (<1.5.140) a
Command injection in PraisonAIAgents memory hooks executor allows authenticated local attackers to execute arbitrary she
Unauthenticated remote session hijacking in PraisonAI's browser bridge (versions <4.5.139) and praisonaiagents (<1.5.140
Server-side request forgery in the SearxNG-backed search tools shipped with the praisonaiagents Python package before 1.
Remote attackers can invoke arbitrary application callables in PraisonAI multi-agent systems by manipulating tool-call n
Exploit-DB