PraisonAI EUVD-2026-108902

Requires a deployment that instantiates a PraisonAI LocalManagedAgent or SandboxedAgent with a compute provider attached (compute="local" via the local subprocess provider, or a Docker provider) AND exposes at least one compute-bridged file tool (read_file, list_files, or write_file). The attacker must be able to influence the file path (or write_file content) argument - e.g. through prompt injection, a chat endpoint, an automation webhook, or any user-controlled agent task - so that shell metacharacters (", ;, $(), backticks, newline, #) in the path break out of the bridge's quoted command string. Limiting factors: this does NOT affect default usage without a compute provider attached (the normal read_file/list_files treat the payload as a literal path and do not expand shell metacharacters); it requires the vulnerable managed/sandboxed agent configuration and the bridged file tools to be enabled; it applies to versions >= 4.6.10 and <= 4.6.58. Notably, exploitation does NOT require the operator to grant the critical-marked execute_command tool, so least-privilege tool configurations that omit execute_command do not mitigate it.

This rates CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and the signals are broadly consistent: network-reachable agent interface, low attack complexity, and full confidentiality/integrity/availability loss because the flaw yields arbitrary shell command execution in the compute environment. Authentication: the supplied vector is PR:L, so exploitation is scoped to an attacker with low-privilege access to an agent interface that can request file-tool use; however, the GHSA advisory explicitly notes that if a deployment exposes such an agent without authentication, PR:N may be appropriate - treat the privilege requirement as deployment-dependent rather than fixed. No CISA KEV listing and no EPSS score are present in the provided data, so there is no evidence of active exploitation and no modeled exploitation probability to weigh; absence of these is not evidence of safety, only of missing signals. A public proof-of-concept reproducer (a harmless local canary-based PoV) is published directly in the GHSA advisory, demonstrating the bypass, though it is not packaged as a weaponized remote exploit. The vendor priority label is 'this_week', which aligns with a serious-but-not-emergency posture: a confirmed, PoC-demonstrated code-execution flaw that requires a specific non-default deployment pattern (a compute provider attached to a managed/sandboxed agent) rather than hitting every default install. One nuance to verify: the provided vector marks S:U, but with compute="local" the injected command executes on the host rather than within the agent's intended tool sandbox, which some assessors would treat as a scope change (S:C); the Docker case stays within the container, so scope depends on the configured compute provider.

An application exposes a PraisonAI LocalManagedAgent or SandboxedAgent with a compute provider attached and a restricted file-tool set (read_file/list_files) but deliberately withholds execute_command. Via a prompt-injection path, chat endpoint, or automation webhook, an attacker supplies a file path such as 'missing"; printf "$CANARY"; #', which the compute bridge wraps into cat "missing"; printf "$CANARY";

and sends to the shell-backed provider, executing attacker commands on the host (compute="local") or inside the container (Docker). A working local PoV demonstrating this is published in the GHSA advisory.