CVE-2026-57117: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in MervinPraison PraisonAI

PraisonAI, a multi-agent teams system, versions 4.6.10 through 4.6.58, contain an OS command injection vulnerability (CWE-78) due to improper neutralization of special elements in shell command strings. The LocalManagedAgent and SandboxedAgent components convert file operations (read_file, list_files, write_file) into shell commands using raw path arguments. An attacker able to influence these path arguments can break out of the quoted path context and execute arbitrary shell commands in the compute environment, either on the local host subprocess or inside a Docker container. This vulnerability is fixed in version 4.6.59.

Successful exploitation allows an attacker with the ability to influence file-tool path arguments to execute arbitrary shell commands with the privileges of the compute provider. This can lead to full compromise of the compute environment, including confidentiality, integrity, and availability impacts. The CVSS v3.1 score is 8.8 (high), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

Upgrade PraisonAI to version 4.6.59 or later, where this vulnerability has been patched. No other mitigations are specified or recommended by the vendor advisory.