CVE-2026-56075: PraisonAI Arbitrary Shell Command Execution Vulnerability

Technical summary

The vulnerability exists in PraisonAI's UI modules, which hardcode approval_mode to 'auto' regardless of the PRAISON_APPROVAL_MODE environment variable setting. This configuration override prevents the manual approval gate from functioning. Combined with insufficient command sanitization in subprocess.run calls (invoked with shell=True), authenticated users can inject arbitrary shell commands that execute with the privileges of the PraisonAI process. The root cause is improper separation between UI-layer defaults and administrator-level security policy configuration, coupled with dangerous shell invocation patterns.

Business impact

Organizations deploying PraisonAI risk unauthorized command execution on servers hosting the application. An insider or compromised account holder could exfiltrate data, install persistence mechanisms, pivot to other systems, or disrupt service availability. The impact is amplified in environments where PraisonAI runs with elevated privileges or network access to sensitive infrastructure. Depending on deployment context, this could lead to complete system compromise and broader lateral movement through the organization's network.

Affected systems

PraisonAI versions before 4.5.128 are affected. No other vendors or products are explicitly identified in the vulnerability record. Deployments running version 4.5.128 or later have received patches. Organizations should verify their installed version and confirm patch application before considering their environment secure.

Exploitability

Exploitation requires valid authentication credentials to access the PraisonAI interface. However, once authenticated, no additional user interaction is needed—the attack is network-accessible and does not require administrator privileges or special system conditions. The attacker needs only to craft a prompt instructing the LLM agent to execute shell commands; the hardcoded approval bypass and weak sanitization make success highly likely. The CVSS score of 8.8 (HIGH) reflects the low attack complexity and broad impact potential, though the authentication requirement reduces the overall severity compared to unauthenticated variants.

Remediation

Upgrade to PraisonAI version 4.5.128 or later, which fixes the hardcoded approval_mode override and improves command sanitization. Organizations should also review their deployment of PraisonAI to ensure it runs with minimal necessary privileges and is isolated from high-value systems or data. Post-patch, verify that the PRAISON_APPROVAL_MODE environment variable is properly respected and that manual approval gates function as intended.

Patch guidance

Apply the update to version 4.5.128 or newer according to the vendor's documented upgrade process. Before deploying to production, test the patch in a non-critical environment to confirm that command approval workflows function correctly and that no legitimate administrative automation is disrupted. Verify that the environment variable PRAISON_APPROVAL_MODE is properly set to enforce manual approval in security-sensitive deployments, and confirm via testing that this setting is no longer overridden.

Detection guidance

Monitor logs for suspicious subprocess.run invocations or shell command execution initiated through PraisonAI's LLM agent interface. Look for unexpected system calls, file system modifications, or network connections originating from the PraisonAI process. Examine authentication logs for unusual access patterns or failed attempts to trigger commands. If approval workflow logs are available, identify cases where 'auto' mode is active despite PRAISON_APPROVAL_MODE environment variable settings that should enforce manual review. Endpoint detection and response (EDR) tools should flag any shell execution from the PraisonAI application context as a potential indicator of exploitation.

Why prioritize this

This vulnerability scores 8.8 (HIGH) and merits immediate attention due to the combination of code execution capability, high integrity and confidentiality impact, and the likelihood of exploitation by anyone with valid credentials. The hardcoded security bypass is a governance failure that security and DevOps teams should remediate quickly. Organizations relying on PraisonAI for production workloads should treat this as a priority patch.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: (1) Network attack vector—accessible over the network without special access; (2) Low attack complexity—no unusual conditions required; (3) Low privilege requirement—authenticated user access suffices; (4) No user interaction needed—the attack is directly executable; (5) High impact on confidentiality, integrity, and availability due to arbitrary command execution. The primary limiting factor is the authentication requirement; an unauthenticated variant would score higher. The score appropriately classifies this as HIGH severity, warranting timely patching across all affected deployments.

Frequently asked questions