PT-2026-61771 · Pypi · Praisonai
CVE-2026-57117
·
Published
2026-06-18
·
Updated
2026-07-23
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
praisonai versions 4.6.10 through 4.6.57
Description
In
LocalManagedAgent and SandboxedAgent, the compute bridging mechanism converts file operations into shell command strings using raw path arguments. This allows an attacker who can influence a file-tool path argument to break out of the quoted path and execute arbitrary shell commands in the compute environment. If compute="local" is used, commands execute on the host via a local subprocess; if Docker is used, they execute within the container. This issue can be triggered through the read file, list files, and write file tools, potentially bypassing least-privilege configurations and tool-approval restrictions. The vulnerability occurs because the bridge file tool() function constructs commands using f-strings that are later executed by asyncio.create subprocess shell() or sh -c, treating user-supplied paths as shell syntax.Recommendations
For versions 4.6.10 through 4.6.57, remove
read file, list files, and write file from compute bridged tools as a temporary mitigation.
Implement provider-native file APIs for read, write, and list operations instead of constructing shell command strings.
Pass arguments as structured argv where supported by the provider.
Ensure write file content is treated as data rather than shell source to prevent heredoc injection.
Maintain normal file-tool path validation and workspace boundary checks for compute-bridged tools.Fix
OS Command Injection
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Praisonai