PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution

The vulnerability lies in how run_python() constructs and executes shell commands. It interpolates user-provided code into a python3 -c "<code>" command and then passes it to subprocess.run(..., shell=True). Critically, the escaping logic only handles backslashes (\) and double quotes ("), failing to properly escape $() and backtick substitutions. This omission allows an attacker to inject arbitrary shell commands that will be executed with the privileges of the praisonaiagents process. A successful exploit could lead to complete system compromise, data exfiltration, or denial of service. The potential blast radius depends on the permissions granted to the praisonaiagents process and the environment it operates within.

Systems utilizing praisonaiagents in automated workflows or integrations where user input is processed and passed to the run_python() function are particularly at risk. Environments with limited input validation or sanitization practices are also highly vulnerable. Shared hosting environments where multiple users share the same server instance could be affected if one user's input compromises the entire system.

• python / supply-chain:

import subprocess
import os

def check_praisonaiagents_version():
    try:
        import praisonaiagents
        version = praisonaiagents.__version__
        if version <= '1.5.9':
            print(f"Vulnerability detected: praisonaiagents version {version} is vulnerable.")
        else:
            print(f"praisonaiagents version {version} is patched.")
    except ImportError:
        print("praisonaiagents is not installed.")

check_praisonaiagents_version()

• linux / server:

ps aux | grep -q 'python3 -c' && echo "Potential command injection vulnerability detected. Investigate praisonaiagents process." || echo "No suspicious praisonaiagents processes found."

• generic web: Use curl or wget to test endpoints that utilize run_python() with crafted payloads containing $() or backticks to attempt command execution. Examine response headers and content for signs of command execution.

1. 2026-04-01Disclosure

   disclosure

2. 2026-04-01Patch

   patch

1. 予約済み2026-03-31
2. 公開日2026-04-01
3. 更新日2026-04-06
4. EPSS 更新日2026-04-11

The primary mitigation is to upgrade to version 1.5.90 or later of praisonaiagents. If upgrading is not immediately feasible, consider implementing temporary workarounds. One approach is to sanitize user-provided code more rigorously before passing it to run_python(), specifically removing or escaping $() and backtick substitutions. Additionally, restrict the permissions of the praisonaiagents process to the minimum necessary to limit the impact of a potential compromise. Consider using a Web Application Firewall (WAF) to filter potentially malicious input. After upgrading, confirm the fix by attempting to inject a simple shell command (e.g., ls -l) through the vulnerable endpoint and verifying that it is not executed.