{"id":"GHSA-qh3g-555w-f82q","kind":"vulnerability","aliases":["GHSA-qh3g-555w-f82q"],"related":[],"title":"Duplicate Advisory: PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-26mh-57q7-jfvr. This link is maintained to preserve external references.\n\n### Original Description\nPraisonAI before 4.6.78 contains a remote code execution vulnerability in JobWorkflowExecutor._exec_inline_python() due to insufficient AST validation of workflow script steps. Attackers can create malicious YAML workflow files with import os statements followed by os.system() calls that bypass sandbox checks and execute arbitrary OS commands with process privileges.","summary":"PraisonAI before 4.6.78 checks workflow script steps with an AST validator that does not block imports such as os followed by os.system() calls. An attacker who can supply a malicious YAML workflow file can run arbitrary operating system commands with the privileges of the PraisonAI process.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"PraisonAI","fixed":[],"affected":"< 4.6.78","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-agents","ai-tooling","cwe-78","praisonai","python","workflow-automation"],"not_affected_if":["no-inline-python-workflows","trusted-workflow-files-only","version-4.6.78-or-later"],"how_to_check":"- Check the installed PraisonAI version with `pip show PraisonAI` and compare it to the affected range below.\n- Look for YAML workflow files that run inline Python steps in any PraisonAI deployment.","fix":"- PraisonAI: move to `4.6.78` or later (per the affected range; the advisory is withdrawn as a duplicate of GHSA-26mh-57q7-jfvr, so confirm the fix there).","status":"withdrawn","published_at":"2026-07-15T12:32:04+00:00","first_seen_at":"2026-10-29T16:39:03+00:00","triaged_at":"2026-10-29T16:39:55+00:00","updated_at":"2026-10-29T16:39:55+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-29T16:39:55Z","model":"claude-haiku-5-5","output":{"fix":"- PraisonAI: move to `4.6.78` or later (per the affected range; the advisory is withdrawn as a duplicate of GHSA-26mh-57q7-jfvr, so confirm the fix there).","reach":"unknown","title":"PraisonAI: broken AST sandbox lets a workflow file run OS commands","impact":"high","summary":"PraisonAI before 4.6.78 checks workflow script steps with an AST validator that does not block imports such as os followed by os.system() calls. An attacker who can supply a malicious YAML workflow file can run arbitrary operating system commands with the privileges of the PraisonAI process.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["praisonai","python","ai-agents","workflow-automation"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker runs arbitrary OS commands as the PraisonAI process","analyst_note":"Advisory is withdrawn as a duplicate; confirm the canonical record GHSA-26mh-57q7-jfvr for the authoritative fix version and attack preconditions.","how_to_check":"- Check the installed PraisonAI version with `pip show PraisonAI` and compare it to the affected range below.\n- Look for YAML workflow files that run inline Python steps in any PraisonAI deployment.","plain_action":"","needs_analyst":true,"not_affected_if":["version-4.6.78-or-later","no-inline-python-workflows","trusted-workflow-files-only"],"who_is_affected":"Teams running PraisonAI workflows that load YAML files containing inline Python script steps, especially where those files can come from users or untrusted sources. Deployments that only run hand-written workflows from trusted authors have a much smaller exposure. unknown whether other PraisonAI entry points are reachable.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000766,"input_tokens":4266,"output_tokens":679,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-78':31B '26mh':98C '4.6.78':39B,113C '555w':16A,21A '57q7':99C 'advisori':2A,84C,86C 'agent':26B 'ai':25B,28B 'ai-ag':24B 'ai-tool':27B 'arbitrari':72B,152C 'ast':11A,46B,125C 'attack':61B,131C 'autom':36B 'block':51B 'broken':10A 'bypass':147C 'call':59B,145C 'check':40B,149C 'code':7A,117C 'command':75B,154C 'contain':114C 'creat':133C 'cwe':30B 'descript':110C 'due':122C 'duplic':1A,83C,94C 'execut':8A,118C,151C 'extern':107C 'f82q':17A,22A 'file':69B,137C 'follow':56B,142C 'ghsa':14A,19A,97C 'ghsa-26mh-57q7-jfvr':96C 'ghsa-qh3g-555w-f82q':13A,18A 'import':52B,139C 'insuffici':124C 'jfvr':100C 'jobworkflowexecutor._exec_inline_python':121C 'link':102C 'maintain':104C 'malici':66B,134C 'oper':73B 'origin':109C 'os':55B,140C,153C 'os.system':58B,144C 'praisonai':3A,23A,32B,37B,81B,111C 'preserv':106C 'privileg':78B,157C 'process':82B,156C 'python':33B 'qh3g':15A,20A 'refer':108C 'remot':6A,116C 'run':71B 'sandbox':12A,148C 'script':42B,129C 'statement':141C 'step':43B,130C 'suppli':64B 'system':74B 'tool':29B 'valid':47B,126C 'via':9A 'vulner':4A,119C 'withdrawn':89C 'workflow':35B,41B,68B,128C,136C 'workflow-autom':34B 'yaml':67B,135C","nicknames":[],"mitigations":[],"who_affected":"Teams running PraisonAI workflows that load YAML files containing inline Python script steps, especially where those files can come from users or untrusted sources. Deployments that only run hand-written workflows from trusted authors have a much smaller exposure. unknown whether other PraisonAI entry points are reachable.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-07-15T12:32:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-qh3g-555w-f82q","url":"https://github.com/advisories/GHSA-qh3g-555w-f82q","severity":"high","published_at":"2026-07-15T12:32:04+00:00","modified_at":"2026-10-29T16:34:19+00:00","first_seen_at":"2026-10-29T16:39:03+00:00","fetched_at":"2026-10-29T16:39:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}