PT-2026-29822 · Praisonai · Praisonai
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
PraisonAI versions 4.5.15 through 4.5.68
Description
PraisonAI is a multi-agent teams system. The
--mcp CLI argument is passed directly to shlex.split() and forwarded through the call chain to anyio.open process() without validation, allowlist checks, or sanitization. This allows arbitrary OS command execution as the process user. The issue resides in the MCPHandler.parse mcp command() function within src/praisonai/praisonai/cli/features/mcp.py, which fails to validate the executable or its arguments. Consequently, an attacker who can influence the MCP server configuration can execute dangerous commands using executables such as bash, python, or /bin/sh with inline code execution flags (e.g., -c or -e).Recommendations
Update PraisonAI to version 4.5.69.
As a temporary mitigation, avoid using the
--mcp CLI argument with untrusted or unvalidated input.Exploit
Fix
RCE
Command Injection
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Praisonai