CVE-2026-56075: PraisonAI - Arbitrary Shell Command Execution via Hardcoded Approval Mode Override

What it is stated by the CNA

PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI modules hardcode approval_mode to auto, overriding administrator configuration from PRAISON_APPROVAL_MODE environment variable. Authenticated attackers can instruct the LLM agent to execute arbitrary shell commands via subprocess.run with shell=True, bypassing the manual approval gate and insufficient command sanitization blocklists.

weakness

CWE-863 Incorrect Authorization

affected

PraisonAI

versions

No affected-version range in held sources.

fixed in

4.5.128

fixed by package (from OSV advisories)

praisonai (PyPI): 4.5.128 GHSA-qwgj-rrpj-75xm

later fixes (from OSV advisories)

praisonai 4.5.128 is inside a range CVE-2026-40287 (GHSA-g985-wjh9-qxxc) lists as affected. That advisory is fixed in 4.5.139.praisonai 4.5.128 is inside a range CVE-2026-40288 (GHSA-vc46-vw85-3wvm) lists as affected. That advisory is fixed in 4.5.139.praisonai 4.5.128 is inside a range CVE-2026-40289 (GHSA-8x8f-54wf-vv92) lists as affected. That advisory is fixed in 4.5.139.praisonai 4.5.128 is inside a range CVE-2026-40315 (GHSA-x783-xp3g-mqhp) lists as affected. That advisory is fixed in 4.5.133.praisonai 4.5.128 is inside a range CVE-2026-41496 (GHSA-rg3h-x3jw-7jm5) lists as affected. That advisory is fixed in 4.5.149.praisonai 4.5.128 is inside a range CVE-2026-41497 (GHSA-9qhq-v63v-fv3j) lists as affected. That advisory is fixed in 4.5.149.

severity

8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

assigned by

VulnCheck

published

2026-06-18

check us github.com vulncheck.com

Exploit code held, dated

exploit code

None held in the PoC-in-GitHub feed. A public repository changes this brief.

What moved held, dated

3 observations held. A step marked with a scoring model moved because the measurement was replaced, not because the vulnerability changed.

Outside the record researched, cited

This section reads the record's references and adds cited findings from outside it. It needs an account. Everything above is held facts and is complete without it.

Sign in to add the researched section

How to check this

Every value above is held with two dates: when it was true upstream (as_of) and when we recorded it (tx_from). Re-derive the exploit probability as it stood on any date:

SELECT value, source, source_version, as_of, tx_from
FROM volatile_valid_as_of('CVE-2026-56075', '2026-10-31T23:59:59.999999Z', now());