CVE-2026-57142: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in MervinPraison PraisonAI
Description
CVE-2026-57142 is a high-severity OS command injection vulnerability in MervinPraison PraisonAI versions 4.5.87 up to but not including 4.6.61. The vulnerability arises because the recipe execution policy that blocks dangerous tools only checks tools declared in TEMPLATE.yaml, but the actual workflow execution loads tools from workflow.yaml, allowing untrusted recipes to self-approve critical shell tools without explicit permission. This flaw enables unauthorized execution of shell commands. The issue has been fixed in version 4.6.61.
CVSS v3.1
Score 7.8high
Affected software
MervinPraison
PraisonAI
pkg:github/mervinpraison/PraisonAIRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
PraisonAI is a multi-agent teams system where recipe execution enforces a dangerous-tool policy to block default-denied tools unless explicitly allowed. This policy checks only tools declared in TEMPLATE.yaml requires.tools. However, for steps-based recipes, the workflow execution path loads agent-level tools declared in workflow.yaml and installs them into the approval context. An untrusted recipe can exploit this by omitting execute_command from TEMPLATE.yaml but declaring it in workflow.yaml agents.*.tools and self-approving it via the top-level approve field. This bypasses the dangerous-tool policy without setting allow_dangerous_tools=True, enabling OS command injection. The vulnerability is patched in version 4.6.61.
Potential Impact
The vulnerability allows an attacker to bypass the dangerous-tool policy and execute arbitrary shell commands via untrusted recipes, potentially leading to full system compromise including confidentiality, integrity, and availability impacts as indicated by the CVSS score of 7.8 (high severity).
Mitigation Recommendations
Upgrade PraisonAI to version 4.6.61 or later where this vulnerability is patched. No other mitigation is indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-24T01:45:48.697Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6adb53864d27ba8daa242bc2
Added to database: 10/23/2026, 12:31:02 UTC
Last enriched: 10/23/2026, 12:45:29 UTC
Last updated: 10/23/2026, 13:31:46 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.