PraisonAI CVE-2026-60085

Exploitation requires that the deployment uses the default Subprocess Sandbox backend and that an attacker can influence the commands/tasks a PraisonAI agent executes (e.g., via a user-facing agent interface or untrusted content the agent processes). The defining condition is that the operator configured security restrictions (blocked_commands, blocked_paths, blocked_imports, allow_subprocess=false, allow_file_write=false) and depends on them - those very restrictions are ignored. Limiting factors: the agent must actually have subprocess/file tooling wired up and be reachable with attacker-controlled instructions; installations that never enabled subprocess execution, that isolate the agent at the OS layer, or that already patched to 4.6.78 are not exposed. Per the CVSS 4.0 vector (PR:N/UI:N) no authentication or user interaction is modeled, but real reachability depends on how the embedding application exposes the agent.

Signals are moderately strong but partly conflicting. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) implies trivially remote, unauthenticated, low-complexity abuse, yet it scores only confidentiality (VC:H) with VI:N/VA:N - this understates the described impact, since arbitrary subprocess execution and 'destructive operations' clearly imply integrity and availability loss; the impact metrics and the prose disagree, and my independent assessment raises integrity/availability to High. There is no EPSS value, no KEV listing, and no evidence of public POC, so this is not confirmed active exploitation - treat it as a high-severity latent risk rather than an in-the-wild campaign. Real-world exploitability hinges on whether a given deployment exposes the agent to untrusted input and relied on the sandbox for protection; those who never trusted the sandbox are less exposed, while those who deployed it as a security boundary are effectively unprotected.

An application built on PraisonAI exposes an agent endpoint and configures the Subprocess Sandbox with blocked_commands including 'rm' and allow_subprocess set to deny, assuming it is protected. An attacker submits a task that induces the agent to invoke a shell command; because the policy is never checked, the command runs and the attacker reads credentials from the filesystem or deletes data. No public POC is currently identified, but the low-complexity network vector makes reproduction straightforward for anyone who can influence agent input.