CVE-2026-61434: PraisonAI allowlist bypass enables

CISO Take

PraisonAI's command-execution guardrail filters shell metacharacters but fails to account for find's built-in -exec, -execdir, and -delete actions, letting an attacker run arbitrary binaries, read blocked files, or delete data without ever triggering the blocklist. The CVSS 8.8 score reflects the full compromise potential — confidentiality, integrity, and availability all rated high — and the attack requires only low privileges, no user interaction, and low complexity, making it trivially reachable by anyone who can get PraisonAI's agent to execute a crafted find command. There is no EPSS data, no known public exploit, and it is not in CISA KEV, so this is not yet under active exploitation, but the technique is well-documented (GitHub Security Advisory GHSA-cv3g-hj65-pcfh, VulnCheck advisory) and trivially reproducible once known. Any deployment where PraisonAI executes LLM-generated or user-supplied shell commands against an allowlist should treat this as a priority patch. Upgrade to PraisonAI 4.6.78 or later immediately, and in the interim audit logs for find invocations containing -exec, -execdir, or -delete flags.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

High risk for any deployment that relies on PraisonAI's shell-command allowlist as a security boundary. The vulnerability is a logic flaw, not a memory-safety or dependency issue, so exploitation is deterministic and reliable once an attacker crafts the right find invocation — there is no fuzzing or timing dependency. Attack complexity is low and no user interaction is required, meaning any component that passes attacker- or LLM-influenced input into the allowlisted shell executor is exposed. The absence of EPSS scoring and KEV listing suggests exploitation has not yet been observed in the wild, but the public advisory and clear reproduction steps significantly lower the bar for weaponization, so the real-world exploitation window should be assumed to be short.

How does the attack unfold?

Initial Access

Attacker gains ability to influence input to a PraisonAI agent's shell command tool, either as a direct low-privileged user or via indirect prompt injection.

AML.T0053

Defense Evasion

Attacker crafts a find command using built-in -exec, -execdir, or -delete actions that evades the shell metacharacter allowlist filter.

AML.T0050

Execution

The bypassed allowlist permits the agent to run the embedded command, reading blocked files or invoking non-allowlisted binaries.

AML.T0102

Impact

Attacker achieves data exfiltration (reading secrets/config), data destruction (via -delete), or arbitrary code execution within the agent's runtime privileges.

AML.T0101

Initial Access

Attacker gains ability to influence input to a PraisonAI agent's shell command tool, either as a direct low-privileged user or via indirect prompt injection.

AML.T0053

Defense Evasion

Attacker crafts a find command using built-in -exec, -execdir, or -delete actions that evades the shell metacharacter allowlist filter.

AML.T0050

Execution

The bypassed allowlist permits the agent to run the embedded command, reading blocked files or invoking non-allowlisted binaries.

AML.T0102

Impact

Attacker achieves data exfiltration (reading secrets/config), data destruction (via -delete), or arbitrary code execution within the agent's runtime privileges.

AML.T0101

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents 69% patched ~12d to patch Full package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.9%

chance of exploitation in 30 days

Higher than 56% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Upgrade PraisonAI to version 4.6.78 or later immediately, where the allowlist logic accounts for find's built-in actions. If immediate patching isn't possible, disable or heavily restrict the shell/command-execution tool for agents that accept untrusted input, and explicitly strip or reject find invocations containing -exec, -execdir, -delete, -fprintf, or similar built-in actions at the tool-invocation layer rather than relying solely on shell metacharacter filtering. Run agent shell tools inside a sandboxed, least-privilege environment (container, restricted user, read-only filesystem where possible) so that even a successful allowlist bypass cannot reach sensitive files or binaries. For detection, monitor agent tool-invocation logs for find commands containing these flags, and alert on any unexpected file deletions or executions originating from the agent runtime.

How is it classified?

Code Execution Auth Bypass Agent Framework AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0101 - Data Destruction via AI Agent Tool Invocation AML.T0102 - Generate Malicious Commands

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2.3 - AI system operation and monitoring

NIST AI RMF

MANAGE 2.3 - Mechanisms for managing AI system risks are in place

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-61434?

PraisonAI's command-execution guardrail filters shell metacharacters but fails to account for find's built-in -exec, -execdir, and -delete actions, letting an attacker run arbitrary binaries, read blocked files, or delete data without ever triggering the blocklist. The CVSS 8.8 score reflects the full compromise potential — confidentiality, integrity, and availability all rated high — and the attack requires only low privileges, no user interaction, and low complexity, making it trivially reachable by anyone who can get PraisonAI's agent to execute a crafted find command. There is no EPSS data, no known public exploit, and it is not in CISA KEV, so this is not yet under active exploitation, but the technique is well-documented (GitHub Security Advisory GHSA-cv3g-hj65-pcfh, VulnCheck advisory) and trivially reproducible once known. Any deployment where PraisonAI executes LLM-generated or user-supplied shell commands against an allowlist should treat this as a priority patch. Upgrade to PraisonAI 4.6.78 or later immediately, and in the interim audit logs for find invocations containing -exec, -execdir, or -delete flags.

Is CVE-2026-61434 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-61434, increasing the risk of exploitation.

How to fix CVE-2026-61434?

Upgrade PraisonAI to version 4.6.78 or later immediately, where the allowlist logic accounts for find's built-in actions. If immediate patching isn't possible, disable or heavily restrict the shell/command-execution tool for agents that accept untrusted input, and explicitly strip or reject find invocations containing -exec, -execdir, -delete, -fprintf, or similar built-in actions at the tool-invocation layer rather than relying solely on shell metacharacter filtering. Run agent shell tools inside a sandboxed, least-privilege environment (container, restricted user, read-only filesystem where possible) so that even a successful allowlist bypass cannot reach sensitive files or binaries. For detection, monitor agent tool-invocation logs for find commands containing these flags, and alert on any unexpected file deletions or executions originating from the agent runtime.

What systems are affected by CVE-2026-61434?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks.

What is the CVSS score for CVE-2026-61434?

CVE-2026-61434 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.88%.

What is the AI security impact?

Affected AI Architectures

agent frameworks

MITRE ATLAS Techniques

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0101 Data Destruction via AI Agent Tool Invocation

AML.T0102 Generate Malicious Commands

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell command execution that allows attackers to execute restricted commands via find's built-in -exec, -execdir, and -delete actions. Attackers can craft find commands with these built-in actions to read blocked files, delete files, or execute non-allowlisted binaries without triggering shell metacharacter filters.

Exploitation Scenario

An attacker interacting with a PraisonAI-powered agent — either directly as a low-privileged user or indirectly via a prompt-injected document the agent processes — steers the agent to execute a find command such as `find / -name secrets.env -exec cat {} \;` or one using -delete against critical files. Because the allowlist filter only inspects for shell metacharacters (pipes, semicolons, backticks) and not find's own built-in execution primitives, the command passes validation and executes with the agent's privileges. The attacker now has read access to blocked files (credentials, API keys, model configs), can delete artifacts to sabotage the pipeline, or chain -exec to run a non-allowlisted binary, achieving code execution beyond what the allowlist was designed to permit — all without any error or filter trigger visible to defenders.

Weaknesses (CWE)

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Primary CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Architecture and Design, Operation] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.