{"id":"EUVD-2026-78421","enisaUuid":"95ad3288-f6d9-3529-a354-5cf58a377dfa","description":"PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, CommandValidator in src/praisonai-ts/src/cli/features/sandbox-executor.ts validates only the first whitespace-delimited executable against allowedCommands, then SandboxExecutor passes the complete command string to sh -c. A command beginning with an allowed executable can append a non-allowlisted command through shell metacharacters, causing arbitrary commands to run with the PraisonAI process privileges. This issue is fixed in version 1.7.2.","datePublished":"Sep 15, 2026, 10:21:29 AM","dateUpdated":"Sep 15, 2026, 12:40:32 PM","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vjv9-7m7j-h833\nhttps://github.com/MervinPraison/PraisonAI/commit/709a0387853709a5e2f2c34680fa64cada252c27\nhttps://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.60\n","aliases":"CVE-2026-57136\nGHSA-vjv9-7m7j-h833\n","assigner":"GitHub_M","epss":0.55,"enisaIdProduct":[{"id":"a84aef24-5006-3ea6-b895-f364e7d077c6","product":{"name":"PraisonAI","vendor":{"name":"mervinpraison"}},"product_version":"1.2.3, \u003c 1.7.2"}],"enisaIdVendor":[{"id":"63af7e6e-58e4-352b-80fc-237127266ee1","vendor":{"name":"mervinpraison"}}],"enisaIdVulnerability":[{"id":"0c2808f1-0370-3700-a608-57cbd7a02d43","vulnerability":{"id":"GHSA-vjv9-7m7j-h833","description":"npm PraisonAI SandboxExecutor allowedCommands bypass via shell chaining","datePublished":"Jun 18, 2026, 2:26:34 PM","dateUpdated":"Jul 20, 2026, 9:27:11 PM","baseScore":0.0,"references":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vjv9-7m7j-h833\nhttps://github.com/MervinPraison/PraisonAI\n","enisa_id":"EUVD-2026-78421\n","aliases":"GHSA-vjv9-7m7j-h833\nCVE-2026-57136\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:49:06 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f6fca582-c7ba-36bd-ad96-6c0e440c13a8","vulnerability":{"id":"CVE-2026-57136","description":"PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, CommandValidator in src/praisonai-ts/src/cli/features/sandbox-executor.ts validates only the first whitespace-delimited executable against allowedCommands, then SandboxExecutor passes the complete command string to sh -c. A command beginning with an allowed executable can append a non-allowlisted command through shell metacharacters, causing arbitrary commands to run with the PraisonAI process privileges. This issue is fixed in version 1.7.2.","datePublished":"Sep 15, 2026, 10:21:29 AM","dateUpdated":"Sep 15, 2026, 12:40:32 PM","status":"PUBLISHED","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vjv9-7m7j-h833\nhttps://github.com/MervinPraison/PraisonAI/commit/709a0387853709a5e2f2c34680fa64cada252c27\nhttps://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.60\n","enisa_id":"EUVD-2026-78421\n","assigner":"GitHub_M","epss":0.55,"dataProcessed":"Nov 11, 2026, 7:22:07 AM","vulnerabilityProduct":[{"id":"b3270443-ce12-3c38-8b84-f86ea65c7c78","product":{"name":"PraisonAI","vendor":{"name":"mervinpraison"}},"product_version":"1.2.3, \u003c 1.7.2"}],"vulnerabilityVendor":[{"id":"ca860a85-a765-3e64-872a-9ec50b7c031d","vendor":{"name":"mervinpraison"}}]}}],"enisaIdAdvisory":[]}