PraisonAIAgents: Environment Variable Secret Exfiltration via os.path.expandvars() Bypassing shell=False in Shell Tool
Date: 2026-04
Affected: pip/praisonaiagents
Attack vector: prompt-injection
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-40153
CWE: CWE-526
CVSS: 7.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N)

## Summary The `execute_command` function in `shell_tools.py` calls `os.path.expandvars()` on every command argument at line 64, manually re-implementing shell-level environment variable expansion despite using `shell=False` (line 88) for security. This allows exfiltration of secrets stored in environment variables (database credentials, API keys, cloud access keys). The approval system displays the **unexpanded** `$VAR` references to human reviewers, creating a deceptive approval where the displayed command differs from what actually executes. ## Details The vulnerable code is in `src/praisonai-agents/praisonaiagents/tools/shell_tools.py`: ```python # Line 60: command is split command = shlex.split(command) # Lines 62-64: VULNERABLE — expands ALL env vars in every argument # Expand tilde and environment variables in command arguments # (shell=False means the shell won't do this for us) command = [os.path.expanduser(os.path.expandvars(arg)) for arg in command] # Line 88: shell=False is supposed to prevent shell feature access process = subprocess.Popen( command, ... shell=False, # Always use shell=False for security ) ``` The security problem is a disconnect between the approval display and actual execution: 1. The LLM generates a tool call: `execute_command(command="cat $DATABASE_URL")` 2. `_check_tool_approval_sync` in `tool_execution.py:558` passes `{"command": "cat $DATABASE_URL"}` to the approval backend 3. `ConsoleBackend` (backends.py:81-85) displa


Mitigations:

Architectural layers (MAESTRO):