PT-2026-50806 · Praisonai · Praisonai

Offset · Publicado 2026-06-18 · Atualizado 2026-06-18 · CVE-2026-56075

NVD

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI modules hardcode approval mode to auto, overriding administrator configuration from PRAISON APPROVAL MODE environment variable. Authenticated attackers can instruct the LLM agent to execute arbitrary shell commands via subprocess.run with shell=True, bypassing the manual approval gate and insufficient command sanitization blocklists.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-56075

Produtos afetados

Praisonai

Referências · 3

• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qwgj-rrpj-75xm · Aviso do Fabricante
• https://vulncheck.com/advisories/praisonai-arbitrary-shell-command-execution-via-hardcoded-approval-mode-override · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-56075 · Nota de Segurança