EUVD-2026-44643
GHSA-qh3g-555w-f82q
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker must supply a local workflow file (AV:L, PR:L) that a user then runs (UI:R); sandbox escape yields full code execution, so C/I/A:H with unchanged scope.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
PraisonAI before 4.6.78 contains a remote code execution vulnerability in JobWorkflowExecutor._exec_inline_python() due to insufficient AST validation of workflow script steps. Attackers can create malicious YAML workflow files with import os statements followed by os.system() calls that bypass sandbox checks and execute arbitrary OS commands with process privileges.
AnalysisAI
OS command execution in PraisonAI before 4.6.78 lets an attacker who can supply a workflow definition escape the inline-Python sandbox and run arbitrary shell commands with the privileges of the agent process. The flaw lives in JobWorkflowExecutor._exec_inline_python(), whose AST-based validation fails to reject import os followed by os.system(), turning a malicious YAML workflow file into RCE. No public exploit code or CISA KEV listing is identified at time of analysis, though the bypass technique is described in detail in the vendor advisory.
Technical ContextAI
PraisonAI is a Python-based multi-agent orchestration framework in which workflows are defined declaratively (typically YAML) and can contain inline Python 'steps' executed by JobWorkflowExecutor. To make inline steps safe, the executor parses each step into an Abstract Syntax Tree (AST) and attempts to block dangerous operations before evaluation. The root cause is CWE-78 (OS Command Injection) arising from incomplete allow/deny logic in that AST walk: the sandbox does not fully account for module imports and attribute-call chains, so a step that performs import os and then calls os.system(...) passes validation and reaches execution. This is a classic sandbox-bypass pattern where a denylist of node types or names is insufficient to contain the full expressiveness of the Python AST. The single affected package is identified by CPE cpe:2.3:a:mervinpraison:praisonai:*:*:*:*:*:*:*:* (all versions prior to the fix).
RemediationAI
Vendor-released patch: 4.6.78 - upgrade PraisonAI to 4.6.78 or later as the primary and definitive fix, per GHSA-26mh-57q7-jfvr (https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-26mh-57q7-jfvr). Until you can upgrade, treat all workflow YAML as untrusted code: restrict who can create or modify workflow files and lock down the directories and pipelines that feed JobWorkflowExecutor so only vetted operators can supply inline-Python steps (trade-off: blocks legitimate self-service workflow authoring). Where possible, disable or avoid inline-Python steps entirely, and run the PraisonAI worker under a dedicated low-privilege service account inside a container or sandbox with no outbound network and minimal filesystem access, so that a successful command-injection is contained (trade-off: added operational overhead and possible loss of functionality for workflows that legitimately shell out). Do not rely on the built-in AST sandbox as a security boundary on pre-4.6.78 versions, since bypassing it is the vulnerability.
WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an att
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Server-side request forgery in PraisonAI's web_crawl() function (versions 1.5.128-1.6.57) allows an attacker who can inf
Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to ex
Remote unauthenticated access to PraisonAI's legacy Flask API server allows attackers to execute configured agent workfl
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Server-Side Request Forgery in PraisonAI before version 4.6.58 allows unauthenticated remote attackers to force the appl
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today