PrisonAI Shell Command Allowlist Bypass via find -exec

Vulnerability Overview Vulnerability Name: Shell command allowlist bypass via built-in action Vulnerability Description: This vulnerability involves a bypass of shell command execution hardening introduced in PrisonAI npm 1.7.2 / Python 4.6.58. The vulnerability allows bypassing the sandbox executor chain via the built-in action of . The fix prevented metacharacters (such as , , , , ) and used with to execute commands. However, remains on the safe command list, and its action executes commands without metacharacters, replacing the blocked terminator with a or terminator. Affected Versions Affected Versions: = 4.6.78 CVSS Score: 8.8 / 10 Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High Remediation Option A: Remove from every sandbox/allow command list (4 locations). This is the simplest fix. Option B: If must be retained, parse arguments and deny the , , , , , , , flags. Proof of Concept (POC) Code 1. Data Exfiltration via (utility-tools.ts) 2. File Deletion 3. Unauthorized Command Execution (side-effect based) 4. Python safe_shell Impact Attackers can achieve the following by manipulating the parameter of (via prompt injection, LLM agents, or direct API input to SandboxExecutor): - Blocked File Reading: reads files from , bypassing via path splitting (verified: exit code 0, data returned). - File Deletion: destroys files without metacharacters (verified: clean exit 0). - Unauthorized Command Execution: runs commands not included in (side effect fires regardless of exit code). References GHSA-5v7-2mng-h8dg: Utility tool safe-command wrapper allowlist bypass via shell chaining (High 8.8) GHSA-vv9h-7m7j-h833: SandboxExecutor allows blockedCommands bypass via shell chaining (High) Fixed Commits: 2e8f67e, 2F877a (2026-06-13)

Goal Reached Thanks to every supporter — we hit 100%!

PrisonAI Shell Command Allowlist Bypass via find -exec

More from this source