Live › vulnerability › GHSA-qh3g-555w-f82q
PraisonAI before 4.6.78 checks workflow script steps with an AST validator that does not block imports such as os followed by os.system() calls. An attacker who can supply a malicious YAML workflow file can run arbitrary operating system commands with the privileges of the PraisonAI process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:39 UTC. All times on this page are UTC.
Teams running PraisonAI workflows that load YAML files containing inline Python script steps, especially where those files can come from users or untrusted sources. Deployments that only run hand-written workflows from trusted authors have a much smaller exposure. unknown whether other PraisonAI entry points are reachable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| PraisonAI | pypi | < 4.6.78 | – |
pip show PraisonAI and compare it to the affected range below.4.6.78 or later (per the affected range; the advisory is withdrawn as a duplicate of GHSA-26mh-57q7-jfvr, so confirm the fix there).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
This advisory has been withdrawn because it is a duplicate of GHSA-26mh-57q7-jfvr. This link is maintained to preserve external references.
PraisonAI before 4.6.78 contains a remote code execution vulnerability in JobWorkflowExecutor._exec_inline_python() due to insufficient AST validation of workflow script steps. Attackers can create malicious YAML workflow files with import os statements followed by os.system() calls that bypass sandbox checks and execute arbitrary OS commands with process privileges.
This page as .md · .json · in your agent: get_signal("GHSA-qh3g-555w-f82q")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.