CVE-2026-57136
Summary
The published npm package praisonai exports SandboxExecutor, CommandValidator, and sandboxExec as "safe command execution with restrictions." When allowedCommands is configured, CommandValidator checks only the first whitespace-delimited token of the command string. SandboxExecutor then passes the entire original string to spawn("sh", ["-c", command]).
With a policy that allows only echo, this direct command is correctly rejected:
cat /tmp/marker
but this chained command is accepted and executed:
echo allowed; cat /tmp/marker
The shell executes cat even though cat is not allowlisted. This bypasses the command allowlist and can execute arbitrary shell commands with the PraisonAI process privileges when an application, CLI workflow, or agent pipeline exposes sandbox command execution to lower-trust users, prompts, or model output.
The PoV is deterministic and local-only. It creates and reads only a temporary marker file.
Technical Details
In src/praisonai-ts/src/cli/features/sandbox-executor.ts, CommandValidator.validate() normalizes the command and authorizes only the first whitespace token:
const normalized = command.toLowerCase().trim();
if (this.allowedCommands) {
const baseCmd = normalized.split(/\s+/)[0];
if (!this.allowedCommands.includes(baseCmd)) {
return { valid: false, reason: Command '${baseCmd}' not in allowlist };
}
}
The denylist does not generally reject shell separators. It blocks a few specific patterns such as ; rm, but not ; cat, &&, ||, backticks, $(), or newline as a general policy boundary.
SandboxExecutor.spawn() then executes the unmodified command string through a shell:
const proc = spawn('sh', ['-c', command], {
cwd: this.config.cwd,
env,
timeout: this.config.timeout,
stdio: ['pipe', 'pipe', 'pipe']
});
That creates a mismatch: the allowlist authorizes one command token, but the shell interprets the whole string as a script.
The published npm:praisonai@1.7.1 dist files preserve the same behavior:
- dist/cli/features
⚡ Watch CVE-2026-57136
Get an email if CVE-2026-57136 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Advisory coverage (1)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-57136)