GitHub Security Advisory: GHSA-2763-cj5r-c79m
Package: PraisonAI (PIP)
Severity: CRITICAL (CVSS 9.6)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 4.5.121
Patched in: 4.5.121

Summary: PraisonAI Vulnerable to OS Command Injection

Details:
The `execute_command` function and workflow shell execution are exposed to user-controlled input via agent workflows, YAML definitions, and LLM-generated tool calls, allowing attackers to inject arbitrary shell commands through shell metacharacters.

---

## Description

PraisonAI's workflow system and command execution tools pass user-controlled input directly to `subprocess.run()` with `shell=True`, enabling command injection attacks. Input sources include:

1. YAML workflow step definitions
2. Agent configuration files (agents.yaml)
3. LLM-generated tool call parameters
4. Recipe step configurations

The `shell=True` parameter causes the shell to interpret metacharacters (`;`, `|`, `&&`, `$()`, etc.), allowing attackers to execute arbitrary commands beyond the intended operation.

---

## Affected Code

**Primary command execution (shell=True default):**
```python
# code/tools/execute_command.py:155-164
def execute_command(command: str, shell: bool = True, ...):
    if shell:
        result = subprocess.run(
            command,  # User-controlled input
            shell=True,  # Shell interprets metacharacters
            cwd=work_dir,
            capture_output=capture_output,
            timeout=timeout,
            env=cmd_env,
            text=True,
        )
```

**Workflow shell step execution:**
```python
# cli/features/job_workflow.py:234-246
def _exec_shell(self, cmd: str, step: Dict) -> Dict:
    """Execute a shell command from workflow step."""
    cwd = step.get("cwd", self._cwd)
    env = self._build_env(step)
    result = subprocess.run(
        cmd,  # From YAML workflow definition
        shell=True,  # Vulnerable to injection
        cwd=cwd,
        env=env,
        capture_output=True,
        text=True,
        timeout=step.get("timeout", 300),
    )
```

**Action orchestrator shell execution:**
```python
# cli/features/action_orchestrator.py:445-460
elif step.action_type == ActionType.SHELL_COMMAND:
    result = subprocess.run(
        step.target,  # User-controlled from action plan
        shell=True,
        capture_output=True,
        text=True,
        cwd=str(workspace),
        timeout=30
    )
```

---

## Input Paths to Vulnerable Code

### Path 1: YAML Workflow Definition

Users define workflows in YAML files that are parsed and executed:

```yaml
# workflow.yaml
steps:
  - type: shell
    target: "echo starting"
    cwd: "/tmp"
```

The `target` field is passed directly to `_exec_shell()` without sanitization.

### Path 2: Agent Configuration

Agent definitions in `agents.yaml` can specify shell commands:

```yaml
# agents.yaml
framework: praisonai
topic: Automated Analysis
roles:
  analyzer:
    role: Data Analyzer
    goal: Process data files
    backstory: Expert in data processing
    tasks:
      - description: "Run analysis script"
        expected_output: "Analysis complete"
        shell_command: "python analyze.py --input data.csv"
```

### Path 3: Recipe Step Configuration

Recipe YAML files can cont