PraisonAI: file-tool path argument injects shell commands into the compute provider

CVSS 8.8CVE-2026-57117AI/ML frameworks & servingcurated

Impact

When a compute provider is attached, PraisonAI's compute bridge turns read_file, list_files and write_file into shell command strings built from the raw path argument. Anything that can influence a path - a prompt, a retrieved document, a tool result - can break out of the quotes and run arbitrary commands wherever that provider executes. With compute="local" the commands run as the agent process on the host, which on a GPU node means the account that holds the device files and the model and dataset mounts. With the Docker provider they run inside the container, limiting but not eliminating the damage. Affected from 4.6.10 up to 4.6.59.

Who can reach it

Anyone who can get text into a file-tool path argument of a running agent: an authenticated user of the agent, or any content the agent ingests. The CVSS vector assumes a low-privileged authenticated actor over the network and no user interaction.

What to do

Upgrade PraisonAI to 4.6.59 and restart the agent workers - a service restart, no node drain. Until then, avoid compute="local" so commands at least land in a container rather than on the host, and keep the agent's service account away from GPU device files, model stores and cluster credentials. Agents that already processed untrusted input should be treated as potentially compromised; rotate any credentials reachable from the compute environment.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-57117 https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-w6h2-fr4q-xvxv

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.