PraisonAI agent framework: shell sandbox escape, unauthenticated MCP/Jobs APIs, and prompt-injection filter bypass disclosed in 17 advisories

Undisclosed·PraisonAI (open-source multi-agent framework, Python/TS)Fixed

An attacker able to influence PraisonAI's shell tool (directly, or via prompt injection into an agent) could bypass its command allowlist by using find's built-in -exec/-execdir/-delete actions, which execute without shell metacharacters; this let the sandboxed shell tool read blocked files like /etc/passwd, delete arbitrary files, and run non-allowlisted binaries already on disk, with the same gap present in four parallel implementations (TS and Python, tool and sandbox-executor versions). The same disclosure batch covers PraisonAI's MCP HTTP-stream server and Async Jobs API both defaulting to no authentication (exposing ~50-tool enumeration and unvalidated tool-call arguments, and an SSRF-capable webhook endpoint reachable via DNS rebinding), plus a prompt-injection filter that only blocks an input when 3 or more detector families fire at once, letting realistic single-vector injections through.

Blast radius

Demonstrated via runtime-confirmed proof-of-concept against PraisonAI 4.6.63/4.6.77: confidentiality, integrity and availability impact rated High (CVSS 8.8) for the shell sandbox bypass (CWE-78), with the MCP transport (CVSS 7.3) and Jobs API SSRF (CVSS 7.2) both rated High; no confirmed in-the-wild victim or breach is disclosed in the advisories — impact is the demonstrated attack capability across any default PraisonAI deployment using these components, not disclosed

Root cause

Each hardening fix validated only the first token of a shell command against an allowlist/blocklist and then blocked shell metacharacters, but never accounted for Unix 'find' having its own built-in execution actions (-exec/-execdir/-delete) that run programs or delete files without using shell syntax at all; separately, the MCP and Jobs API servers only added their authentication middleware when an operator explicitly set an API key, so the unauthenticated state was the unconfigured default.

How it was caught

Found and reported through security research/responsible disclosure with runtime proof-of-concept exploitation (not caught via production monitoring); GitHub reviewed and published the advisories on 2026-10-08.

What changed

PraisonAI shipped patched versions (4.6.78) for the affected components; GitHub's suggested remediation for the shell bypass is to remove 'find' from the safe/allowed command lists or explicitly reject its -exec/-execdir/-delete/-ok/-okdir flags.

Take-awayWhen allowlisting shell commands for an agent's tool-use, block by command *behavior* (any form of nested execution or file deletion), not just by binary name or shell metacharacters — and never ship authentication as opt-in on agent-facing network APIs.