EUVD-2026-44636
GHSA-65c8-r727-2mpj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Ignored sandbox allows attacker-influenced arbitrary command execution with no auth or interaction modeled, yielding full confidentiality, integrity, and availability impact; scope unchanged as the OS is the sandbox's own host.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
PraisonAI before 4.6.78 contains an unenforced security policy vulnerability in the default Subprocess Sandbox backend where blocked_commands, blocked_paths, blocked_imports, allow_subprocess, and allow_file_write restrictions are completely ignored. Attackers can execute arbitrary subprocess commands, read sensitive files, and perform destructive operations despite explicit security policy configuration.
AnalysisAI
Security-policy bypass in PraisonAI before 4.6.78 renders the default Subprocess Sandbox backend inert, so administrator-defined blocked_commands, blocked_paths, blocked_imports, allow_subprocess, and allow_file_write restrictions are silently ignored. Any actor able to feed instructions into a PraisonAI agent can execute arbitrary subprocess commands, read sensitive files, and perform destructive file operations even though an explicit deny policy is configured. Reported by VulnCheck with a CVSS 4.0 base score of 8.7; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
PraisonAI is a Python-based multi-agent AI framework (CPE cpe:2.3:a:mervinpraison:praisonai) that lets LLM-driven agents run tools, including a Subprocess Sandbox backend intended to constrain what commands, paths, and imports an agent may touch. The flaw maps to CWE-273 (Improper Check for Dropped Privileges): the sandbox accepts and stores the security policy (blocked_commands, blocked_paths, blocked_imports, allow_subprocess, allow_file_write) but never evaluates it at execution time, so the guardrails are configuration theater. Because the sandbox is the DEFAULT backend, deployments that appear to be hardened are in fact running with no enforcement, and any command the agent generates or is coerced into running reaches the underlying OS.
RemediationAI
Vendor-released patch: upgrade PraisonAI to version 4.6.78 or later, which restores enforcement of the sandbox policy; see the advisory at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-5r6c-gj4g-r697. Until upgrade is possible, do not rely on the Subprocess Sandbox as a security boundary: disable the subprocess/tool-execution capability entirely (do not set allow_subprocess/allow_file_write true), run the agent process under a dedicated low-privilege OS account inside a container or VM with a read-only filesystem and no network egress, and apply external OS-level controls (seccomp/AppArmor/SELinux, filesystem ACLs) to replicate the intended blocked_commands and blocked_paths - accepting that these coarser controls may block legitimate agent actions and require tuning. Restrict who and what can supply prompts/tasks to the agent so untrusted input cannot reach command execution.
WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an att
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Remote unauthenticated access to PraisonAI's legacy Flask API server allows attackers to execute configured agent workfl
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Server-Side Request Forgery in PraisonAI before version 4.6.58 allows unauthenticated remote attackers to force the appl
Memory exhaustion in PraisonAI's MCP HTTP Stream server allows remote unauthenticated attackers to crash the service by
Remote code execution in PraisonAI before 1.6.78 allows attackers to run arbitrary Python on the host by manipulating th
Unauthorized filesystem mutation in praisonaiagents allows an LLM-controlled agent to rewrite arbitrary on-disk source f
Same weakness CWE-273 – Improper Check for Dropped Privileges
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today