CVE-2026-56075highCWE-863

CVE-2026-56075: falha de alta gravidade em PraisonAI

PraisonAI - Arbitrary Shell Command Execution via Hardcoded Approval Mode Override

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar PraisonAI+ Monitorar praisonai

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.6%
PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI modules hardcode approval_mode to auto, overriding administrator configuration from PRAISON_APPROVAL_MODE environment variable. Authenticated attackers can instruct the LLM agent to execute arbitrary shell commands via subprocess.run with shell=True, bypassing the manual approval gate and insufficient command sanitization blocklists.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
PraisonAI · PraisonAI
CVEs relacionadas — PraisonAI

No mesmo produto, das mais perigosas para as menos.

CVE-2026-56078HIGHPraisonAI - Arbitrary File Read and Write via Path Traversal in MultiAgentMonitorEPSS 0.9%CVE-2026-56076HIGHPraisonAI - Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI EndpointEPSS 0.6%CVE-2026-56077HIGHPraisonAI - Information Disclosure via Shared MultiAgentLedger StateEPSS 0.4%CVE-2026-58653MEDIUMPraisonAI - Authorization Bypass via Unvalidated project_id in Issue Create/UpdateEPSS 0.3%CVE-2026-56074MEDIUMPraisonAI - Tool Approval Cache Bypass via Coarse-Grained CachingEPSS 0.2%