CVE-2026-57117— PraisonAI: Compute-bridged file tools allow shell command injection
Quick assessment
Affected
MervinPraison PraisonAI
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PraisonAI 是一个多智能体团队系统。在版本 4.6.10 至 4.6.59 之前，当附加计算提供者时，LocalManagedAgent 和 SandboxedAgent 的计算桥接机制会对 read_file、list_files 和 write_file 操作进行封装。该桥接机制将上述文件操作转换为包含原始路径参数的 Shell 命令字符串，随后将这些字符串发送给基于 Shell 的计算提供者。若攻击者能够操控文件工具的路径参数，即可突破引号对路径的封装限制，在计算环境中执行任意 Shell 命令。当配
Possible ATT&CK Techniques 2 AI
T1203 · Exploitation for Client Execution T1059 · Command and Scripting InterpreterAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| MervinPraison | PraisonAI | >= 4.6.10, < 4.6.59 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-57117
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PraisonAI: Compute-bridged file tools allow shell command injection
Source: CVE Program / CVE List V5
Vulnerability Description
PraisonAI is a multi-agent teams system. From version 4.6.10 to before version 4.6.59, LocalManagedAgent / SandboxedAgent compute bridging wraps read_file, list_files, and write_file when a compute provider is attached. The bridge converts those file operations into shell command strings using raw path arguments, then sends those strings to shell-backed compute providers. An attacker who can influence a file-tool path argument can break out of the quoted path and execute arbitrary shell commands in the compute environment. With compute="local", commands execute through the local subprocess compute provider on the host. With Docker, commands execute in the container. This issue has been patched in version 4.6.59.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MervinPraison | PraisonAI | >= 4.6.10, < 4.6.59 | - |
|
II. Public POCs for CVE-2026-57117
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-57117
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-57117 (1)
Same Patch Batch · MervinPraison · 2026-10-23 · 16 CVEs total
| CVE-2026-57116 | 9.8 CRITICAL | PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remo |
| CVE-2026-56832 | 8.8 HIGH | PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals |
| CVE-2026-56840 | 8.8 HIGH | PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-pa |
| CVE-2026-57144 | 8.8 HIGH | PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is |
| CVE-2026-56837 | 8.6 HIGH | PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing |
| CVE-2026-56835 | 8.3 HIGH | PraisonAI Slack app_mention bypasses configured user/channel authorization |
| CVE-2026-56836 | 8.2 HIGH | PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard |
| CVE-2026-57113 | 8.1 HIGH | PraisonAI GitHub template cache path traversal allows outside-cache file write and directo |
| CVE-2026-57121 | 8.1 HIGH | PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' co |
| CVE-2026-56838 | 7.8 HIGH | PraisonAI recipe.run_stream skips dangerous-tool policy enforcement |
| CVE-2026-57142 | 7.8 HIGH | PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous |
| CVE-2026-56833 | 7.5 HIGH | PraisonAI Dynamic Context history and terminal tools read files outside configured storage |
| CVE-2026-56834 | 7.5 HIGH | PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storag |
| CVE-2026-57146 | 7.5 HIGH | PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated b |
| CVE-2026-57114 | 7.2 HIGH | PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding |
IV. Related Vulnerabilities
Same product: PraisonAI
-
CVE-2026-57146
PraisonAI A2U incomplete authentication fix leaves current s -
CVE-2026-57144
PraisonAI SandlockSandbox falls back to unrestricted subproc -
CVE-2026-57142
PraisonAI recipe workflow policy can be bypassed by declarin -
CVE-2026-57121
PraisonAI: Missing ownership check on DELETE endpoints allow -
CVE-2026-57116
PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 p
Same vendor: MervinPraison
-
CVE-2026-57146
PraisonAI A2U incomplete authentication fix leaves current s -
CVE-2026-57144
PraisonAI SandlockSandbox falls back to unrestricted subproc -
CVE-2026-57142
PraisonAI recipe workflow policy can be bypassed by declarin -
CVE-2026-57121
PraisonAI: Missing ownership check on DELETE endpoints allow -
CVE-2026-57116
PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 p
Same weakness: CWE-78
-
CVE-2026-115586
virtualenv: Bash activator leaves the --prompt value unescap -
CVE-2026-39902
Cacti: Authenticated RCE on Data Input -
CVE-2026-114355
DJI CrystalSky ZS600C hardware_monitor evaluates attacker-co -
CVE-2026-57142
PraisonAI recipe workflow policy can be bypassed by declarin -
CVE-2026-56838
PraisonAI recipe.run_stream skips dangerous-tool policy enfo
V. Comments for CVE-2026-57117
No comments yet