PraisonAI Flaw Lets Attackers Bypass Shell Security via Find -exec Command

A newly disclosed vulnerability in PraisonAI, a popular open-source Python and TypeScript framework for building AI agents, shows how a well-intentioned security fix can leave a backdoor hidden in plain sight.

Tracked as GHSA-cv3g-hj65-pcfh and rated High severity (CVSS 8.8), the flaw allows attackers to bypass shell command hardening using nothing more exotic than the Unix find command.

The advisory, published by PraisonAI maintainer MervinPraison, affects all versions up to 4.6.77 and has been patched in 4.6.78.

PraisonAI Flaw

PraisonAI previously fixed two related vulnerabilities, GHSA-5jv7-2mjm-h6qj and GHSA-vjv9-7m7j-h833, that let attackers chain shell commands using metacharacters like ;, |, and ` .

The fix was sound in principle: block shell metacharacters via regex, and execute commands using spawn() or subprocess.Popen() with shell: false, which prevents the OS shell from interpreting dangerous symbols.

The problem is that find doesn’t need the shell to misbehave. It has built-in execution actions, -exec, -execdir, -delete, -ok, and -okdir, that find itself interprets, entirely independent of shell metacharacter parsing. A command like:

find /etc -name passwd -maxdepth 1 -execdir cat {} +

uses the + batch terminator instead of the blocked ; terminator, so it sails past the metachar regex, contains no $() substitution, and find remains on the safe command allowlist. The result: spawn() dutifully executes find with shell: false, and find quietly runs cat on /etc/passwd on its own.

This same gap exists identically across four separate implementations: the TypeScript utility-tools.ts shell wrapper, the TypeScript SandboxExecutor, and their Python counterparts safe_shell.py and sandbox_executor.py. All four validate only the first token of a command against an allowlist, then trust the rest.

The vulnerability enables three distinct attack paths, each verified with proof-of-concept code:

Blocked file reads: -execdir reads restricted files like /etc/passwd by splitting the path across separate arguments, evading substring-based path filters entirely
File deletion: -delete removes files with a clean exit code and no metacharacters involved
Arbitrary command execution: -exec can run binaries not on the allowlist, such as wget or curl, since the side effect fires regardless of find‘s own exit status

Because PraisonAI’s shell tools are commonly exposed to LLM agents, an attacker doesn’t need direct access to the system. Prompt injection alone, tricking an agent into executing attacker-crafted text, is enough to trigger the exploit, requiring no privileges and no user interaction.

Mitigation

The advisory outlines two fix paths. The simplest is removing find from all four safe-command allowlists. A more permissive alternative involves parsing find‘s arguments and explicitly rejecting the dangerous flags: -exec, -execdir, -delete, -fls, -fprint, -fprintf, -ok, and -okdir.

PraisonAI’s maintainers shipped fixes in commits 2adfe7e and 2f9677a on June 13, 2026, along with regression tests targeting each bypass technique. Organizations running PraisonAI in agentic workflows should upgrade to 4.6.78 or later immediately, particularly if their deployments process untrusted or LLM-generated input.

The flaw underscores a recurring lesson in command sandboxing: allowlisting binary names isn’t the same as constraining what those binaries can do once launched.