PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI modules hardcode approval_mode to auto, overriding administrator configuration ...
Date: 2026-06
Attack vector: rce
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-40112
CVE-2026-40113
CVE-2026-40114
CVE-2026-40115
CVE-2026-40116
CVE-2026-40148
CVE-2026-40149
CVE-2026-40154
CVE-2026-40156
CVE-2026-40157
CVE-2026-40158
CVE-2026-40159
CVE-2026-56074
CVE-2026-56075
CWE: CWE-200
CWE-214
CWE-22
CWE-306
CWE-396
CWE-409
CWE-426
CWE-693
CWE-770
CWE-79
CWE-829
CWE-863
CWE-88
CWE-918
CWE-94
CWE-942
CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI modules hardcode approval_mode to auto, overriding administrator configuration from PRAISON_APPROVAL_MODE environment variable. Authenticated attackers can instruct the LLM agent to execute arbitrary shell commands via subprocess.run with shell=True, bypassing the manual approval gate and insufficient command sanitization blocklists.


Mitigations:

Architectural layers (MAESTRO):