Which versions of PraisonAI are affected by CVE-2026-56075?

PraisonAI before version 4.5.128 contains a high-severity arbitrary command execution vulnerability affecting authenticated users.. A patch is available.

How to fix or mitigate CVE-2026-56075?

24 hours: Immediately inventory all PraisonAI deployments and document versions; restrict UI access to authorized administrators only; disable or isolate affected systems if running version before 4.5.128. 7 days: Implement strict input validation to block shell metacharacters and dangerous commands; enable comprehensive logging of LLM prompts and subprocess execution; enforce MFA for all PraisonAI access. 30 days: Upgrade to version 4.5.128 or later when released; conduct security code review of approval_mode implementation; evaluate refactoring to replace shell=True subprocess calls with allowlist-based command execution.

PraisonAI CVE-2026-56075

Q: What is the CVSS score of CVE-2026-56075?

CVE-2026-56075 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-37959 HIGH

Incorrect Authorization (CWE-863)

2026-06-18 VulnCheck

GHSA-gx4r-3wg8-9w5x

Authentication Bypass Praisonai

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

UI is network-reachable HTTP with low complexity; requires an authenticated UI account (PR:L); no user interaction; full RCE on host yields high C/I/A with unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 19, 2026 - 02:01 EUVD

Source Code Evidence Fetched

Jun 18, 2026 - 23:15 vuln.today

Analysis Generated

Jun 18, 2026 - 23:15 vuln.today

DescriptionCVE.org

PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI modules hardcode approval_mode to auto, overriding administrator configuration from PRAISON_APPROVAL_MODE environment variable. Authenticated attackers can instruct the LLM agent to execute arbitrary shell commands via subprocess.run with shell=True, bypassing the manual approval gate and insufficient command sanitization blocklists.

AnalysisAI

Arbitrary shell command execution in PraisonAI before 4.5.128 allows authenticated UI users to bypass the human-in-the-loop approval gate because the Chainlit chat and code UI modules hardcode approval_mode='auto' after loading administrator config from PRAISON_APPROVAL_MODE. Once auto-approved, prompts to the LLM agent reach subprocess.run with shell=True, and the existing blocklists only filter command chaining operators - leaving single destructive commands (rm -rf, curl, dd, chmod) executable. No public exploit identified at time of analysis beyond the vendor PoC; not currently listed in CISA KEV.

Technical ContextAI

PraisonAI is an open-source multi-agent LLM framework (PyPI package 'praisonai') that exposes a Chainlit-based web UI for chat and code agents. Its Agent Command Protocol (ACP) tool layer includes an approval orchestrator with three documented modes - auto, manual, scoped - read by ToolConfig.from_env() in interactive_tools.py. The flaw is rooted in CWE-863 (Incorrect Authorization): in chat.py:156-159 and code.py:155-158 the loaded config object is mutated with config.approval_mode='auto', so acp_execute_command in agent_tools.py:347 always evaluates auto_approve=True and the action_orchestrator calls subprocess.run(step.target, shell=True, cwd=workspace, timeout=30). Two sanitizers (_sanitize_command and _apply_step) block shell metacharacters ($, `, &&, ||, >, |, ;, &, newlines) but not single binary invocations, so any one-process destructive command passes.

RemediationAI

Vendor-released patch: upgrade praisonai to 4.5.128 or later (pip install --upgrade praisonai), which restores honoring of the PRAISON_APPROVAL_MODE environment variable in the Chainlit UI modules; see GHSA-qwgj-rrpj-75xm. If immediate upgrade is not possible, compensating controls are: stop running 'praisonai ui chat' and 'praisonai ui code' (the CLI/SDK invocation paths are not in scope of this advisory), change default UI credentials and place the UI behind an authenticating reverse proxy or VPN to shrink the authenticated-attacker population, and as an in-place hotfix delete the 'config.approval_mode = "auto"' line in chat.py:158 and code.py:157 so PRAISON_APPROVAL_MODE=manual or scoped is actually enforced - side effect is that every ACP shell action will now prompt, which is the intended behavior but disruptive for automation flows that depended on silent auto-approve. Do not rely on the existing _sanitize_command/_apply_step blocklists as a control; they do not block single-command destructive binaries.