CVE-2026-61434: PraisonAI Allowlist Bypass in Shell Command Execution

Technical summary

The vulnerability is a shell command allowlist bypass (CWE-78: OS Command Injection) in PraisonAI's command execution layer. The product implements a filter designed to block shell metacharacters and restrict command execution to an allowlist. However, the filter does not account for `find` command semantics: the `-exec` action (and variants `-execdir`) allow arbitrary command execution within the `find` context, and `-delete` enables file deletion. Because these are treated as `find` arguments rather than shell metacharacters, they bypass the intended restrictions. An authenticated user can craft a `find` command—which passes the allowlist—and chain it with these actions to execute restricted operations without invoking the shell's metacharacter parsing logic.

Business impact

An authenticated user—such as a disgruntled employee, compromised internal account, or lateral-movement attacker—can exploit this to read sensitive files (configuration, credentials, private data), delete critical application or system files (causing denial of service), or execute code outside the intended security boundary. Organizations using PraisonAI in multi-tenant or untrusted-user scenarios face elevated risk of data exfiltration, system manipulation, and privilege escalation. Remediation requires an immediate upgrade to protect confidentiality, integrity, and availability of systems relying on PraisonAI's command isolation.

Affected systems

PraisonAI versions before 4.6.78 are affected. Organizations running PraisonAI should verify their installed version and prioritize upgrades. Exposure is limited to authenticated users—the attacker must possess valid login credentials or have gained initial access to the system.

Exploitability

Exploitation requires authentication (PR:L in CVSS), but no complex interactions or special conditions are needed once authenticated. The attack is straightforward: an attacker with a valid account can issue a specially crafted `find` command using `-exec` or `-delete` actions. The CVSS score of 8.8 (HIGH) reflects the broad impact (read, write, execute) and low attack complexity once access is obtained. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, but the simplicity of the attack—merely constructing valid `find` syntax—means exploitation could be rapid if an attacker is aware of the flaw.

Remediation

Upgrade PraisonAI to version 4.6.78 or later as soon as possible. Verify the patched version is deployed across all instances, development environments, and integrations. In the interim, restrict command execution privileges to trusted users only and monitor user activity logs for suspicious `find` command patterns. If immediate patching is not feasible, consider disabling or restricting access to PraisonAI's command execution features.

Patch guidance

Consult the official PraisonAI release notes and advisory for version 4.6.78 to confirm the fix addresses the allowlist bypass in `find` command handling. Verify the patch is deployed to all running instances, containers, and orchestrated environments. Test in a staging environment before rolling out to production to ensure compatibility with your workflow. Confirm that the allowlist enforcement now properly restricts `find` actions such as `-exec` and `-delete`.

Detection guidance

Monitor application and system logs for authenticated users executing `find` commands with `-exec`, `-execdir`, or `-delete` flags, especially in environments where such usage is unexpected. Inspect command audit logs (e.g., auditd on Linux, Windows Event Log) for anomalous `find` invocations followed by unexpected file modifications or command executions. Use allowlist-based intrusion detection rules to flag `find` commands originating from PraisonAI processes that include these suspicious actions. Log retention and forensic analysis of user activity can help identify compromise attempts.

Why prioritize this

This vulnerability merits immediate priority despite not yet appearing on the CISA KEV list. The CVSS score of 8.8 indicates high severity with broad impact (confidentiality, integrity, availability). The attack requires only authentication—a much lower bar than network accessibility alone—and the exploit method is trivial to execute once the bypass is known. Organizations should treat this as a 'patch now' risk, particularly if PraisonAI is used in multi-user or exposed environments. The simplicity of the bypass means public awareness and exploitation will likely follow quickly once details are widely known.

Risk score, explained

CVSS 3.1 score 8.8 (HIGH) is justified by: AV:N (network accessible, e.g., via web interface or API), AC:L (low attack complexity; no special conditions needed), PR:L (requires a valid user login), UI:N (no user interaction required), S:U (impact stays within the vulnerable component), C:H (confidentiality breach—arbitrary file read), I:H (integrity breach—file deletion, command execution), A:H (availability impact—resource consumption, service disruption). The score appropriately reflects the severity for authenticated attackers and should drive rapid remediation.

Frequently asked questions