GHSA-2763-cj5r-c79m: PraisonAI Vulnerable to OS Command Injection
The `execute_command` function and workflow shell execution are exposed to user-controlled input via agent workflows, YAML definitions, and LLM-generated tool calls, allowing attackers to inject arbitrary shell commands through shell metacharacters.DescriptionPraisonAI's workflow system and command execution tools pass user-controlled input directly to `subprocess.run()` with `shell=True`, enabling command injection attacks. Input sources include:YAML workflow step definitionsAgent configuration files (agents.yaml)LLM-generated tool call parametersRecipe step configurationsThe `shell=True` parameter causes the shell to interpret metacharacters (`;`, `|`, `&&`, `$()`, etc.), allowing attackers to execute arbitrary commands beyond the intended operation.Affected Code**Primary command execution (shell=True default):****Workflow shell step execution:****Action orchestrator shell execution:**Input Paths to Vulnerable CodePath 1: YAML Workflow DefinitionUsers define workflows in YAML files that are parsed and executed:The `target` field is passed directly to `_exec_shell()` without sanitization.Path 2: Agent ConfigurationAgent definitions in `agents.yaml` can specify shell commands:Path 3: Recipe Step ConfigurationRecipe YAML files can contain shell command steps that get executed when the recipe runs.Path 4: LLM-Generated Tool CallsWhen using agent mode, the LLM can generate tool calls including shell commands:Proof of ConceptPoC 1: YAML Workflow Injection**Malicious workflow file:****Execution:****Result:** Both the `echo` and `curl` commands execute. The `curl` command exfiltrates `/etc/passwd` to the attacker's server.PoC 2: Agent Configuration Injection**Malicious agents.yaml:****Execution:****Result:** The `wget` command sends the user's private SSH key to attacker's server.PoC 3: Direct API InjectionPoC 4: LLM Prompt Injection ChainIf an attacker can influence the LLM's context (via prompt injection in a document the agent processes), they can generate malicious tool calls:ImpactThis vulnerability allows execution of unintended shell commands when untrusted input is processed.An attacker can:Read sensitive files and exfiltrate dataModify or delete system filesExecute arbitrary commands with user privilegesIn automated environments (e.g., CI/CD or agent workflows), this may occur without user awareness, leading to full system compromise.Attack ScenariosScenario 1: Shared Repository AttackAttacker submits PR to open-source AI project containing malicious `agents.yaml`. CI pipeline runs praisonai → Command injection executes in CI environment → Secrets stolen.Scenario 2: Agent Marketplace PoisoningMalicious agent published to marketplace with "helpful" shell commands. Users download and run → Backdoor installed.Scenario 3: Document-Based Prompt InjectionAttacker shares document with hidden prompt injection. Agent processes document → LLM generates malicious shell command → RCE.RemediationImmediate**Disable shell by default**
Use `shell=False` unless explicitly required.**Validate input**
Reject commands containing dangerous characters (`;`, `|`, `&`, `$`, etc.).**Use safe execution**
Pass commands as argument lists instead of raw strings.Short-term**Allowlist commands**
Only permit trusted commands in workflows.**Require explicit opt-in**
Enable shell execution only when clearly specified.**Add logging**
Log all executed commands for monitoring and auditing.ResearcherLakshmikanthan K (letchupkt)
CVSS v3.1: 9.6