Skip to content
AI Sec Watch
HighVulnerability

GHSA-26mh-57q7-jfvr: PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox

Source
GitHub Advisory(opens in a new tab)
Identifiers
CVE-2026-61438GHSA-26mh-57q7-jfvr
Published
Record updated
View JSON
Affected
  • praisonai < 4.6.78
Fixed in
4.6.78
Known exploitation
Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS
0.3%

Summary

PraisonAI's JobWorkflowExecutor._exec_inline_python() runs inline Python from YAML workflow script: steps after AST validation, but the module import allowlist (allowed_modules) includes 'os', and the AST allowlist permits ast.Import, ast.Call and ast.Attribute nodes. A script such as "import os; os.system(...)" passes validation, so arbitrary OS commands run with the privileges of the calling process when PRAISONAI_ALLOW_JOB_WORKFLOWS=true and a workflow is executed via praisonai workflow run. The source notes the risk is greatest in multi-tenant or CI environments where workflows come from untrusted sources.

Mitigation

Remove 'os' from allowed_modules and allow only 'os.path' by explicitly handling it, for example by permitting 'from os.path import ...' only and blocking other os submodules. The source's recommended code replaces the set with {'datetime', 'time', 'json', 'math', 're', 'collections', 'itertools', 'pathlib'} and adds an ImportFrom check for node.module == 'os.path'. No fixed version is stated in the source.

Related items