{"id":"CVE-2026-57117","kind":"vulnerability","aliases":["CVE-2026-57117"],"related":[],"title":"PraisonAI: file tools let attackers run shell commands on hosts","description":"PraisonAI is a multi-agent teams system. From version 4.6.10 to before version 4.6.59, LocalManagedAgent / SandboxedAgent compute bridging wraps read_file, list_files, and write_file when a compute provider is attached. The bridge converts those file operations into shell command strings using raw path arguments, then sends those strings to shell-backed compute providers. An attacker who can influence a file-tool path argument can break out of the quoted path and execute arbitrary shell commands in the compute environment. With compute=\"local\", commands execute through the local subprocess compute provider on the host. With Docker, commands execute in the container. This issue has been patched in version 4.6.59.","summary":"PraisonAI's compute bridge builds shell command strings from raw file-tool path arguments, so a crafted path can break out of its quotes. An attacker who controls that path can run arbitrary shell commands in the compute environment, on the host with compute=\"local\" or inside the container with Docker.","severity":"high","cvss":8.8,"epss":0.00567,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","praisonai","python","self-hosted"],"not_affected_if":["no-compute-provider-attached","version-4.6.59-or-later"],"how_to_check":"Check whether the installed praisonai version is from 4.6.10 up to but not including 4.6.59. Check whether LocalManagedAgent or SandboxedAgent is used with a compute provider attached.","fix":"Upgrade praisonai to 4.6.59 or later.","status":"open","published_at":"2026-10-23T13:17:10+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-23T22:31:09+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-23T22:31:09Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade praisonai to 4.6.59 or later.","reach":"unknown","title":"PraisonAI: file tools let attackers run shell commands on hosts","impact":"high","summary":"PraisonAI's compute bridge builds shell command strings from raw file-tool path arguments, so a crafted path can break out of its quotes. An attacker who controls that path can run arbitrary shell commands in the compute environment, on the host with compute=\"local\" or inside the container with Docker.","category":"ai-tooling","who_cares":["python","praisonai","self-hosted","ai-agents"],"confidence":0.8,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary shell commands in the compute environment or host.","analyst_note":"Confirm from the NVD entry or the PraisonAI advisory whether attacker-controlled path input can reach file tools through LLM prompts or only through direct API input.","how_to_check":"Check whether the installed praisonai version is from 4.6.10 up to but not including 4.6.59. Check whether LocalManagedAgent or SandboxedAgent is used with a compute provider attached.","needs_analyst":true,"not_affected_if":["version-4.6.59-or-later","no-compute-provider-attached"],"user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000786,"input_tokens":3036,"output_tokens":964,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-57117':13A,16A '4.6.10':90C '4.6.59':94C,192C 'agent':19B,85C 'ai':18B,21B 'ai-ag':17B 'ai-tool':20B 'arbitrari':61B,157C 'argument':42B,126C,147C 'attach':112C 'attack':5A,54B,138C 'back':134C 'break':48B,149C 'bridg':31B,98C,114C 'build':32B 'command':8A,34B,63B,121C,159C,167C,180C 'comput':30B,66B,72B,97C,109C,135C,162C,165C,173C 'contain':77B,184C 'control':56B 'convert':115C 'craft':45B 'cve':11A,14A 'docker':79B,179C 'environ':67B,163C 'execut':156C,168C,181C 'file':2A,39B,101C,103C,106C,117C,144C 'file-tool':38B,143C 'host':10A,27B,70B,177C 'influenc':141C 'insid':75B 'issu':186C 'let':4A 'list':102C 'local':73B,166C,171C 'localmanagedag':95C 'multi':84C 'multi-ag':83C 'oper':118C 'patch':189C 'path':41B,46B,58B,125C,146C,154C 'praisonai':1A,23B,28B,80C 'provid':110C,136C,174C 'python':24B 'quot':52B,153C 'raw':37B,124C 'read':100C 'run':6A,60B 'sandboxedag':96C 'self':26B 'self-host':25B 'send':128C 'shell':7A,33B,62B,120C,133C,158C 'shell-back':132C 'string':35B,122C,130C 'subprocess':172C 'system':87C 'team':86C 'tool':3A,22B,40B,145C 'use':123C 'version':89C,93C,191C 'wrap':99C 'write':105C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-57117","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57117","severity":null,"published_at":"2026-10-23T13:17:10+00:00","modified_at":"2026-10-23T13:17:11+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-57117","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-57117","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}