PraisonAI is a multi-agent teams system. Prior to 4.5.121, the execute_command function and workflow shell execution are exposed to user-controlled input via agent workflows, YAML definitions, and LLM-generated tool calls, allowing attackers to inject arbitrary shell commands through shell metacharacters. This vulnerability is fixed in 4.5.121.

Affected: PyPI: PraisonAI

The `execute_command` function and workflow shell execution are exposed to user-controlled input via agent workflows, YAML definitions, and LLM-generated tool calls, allowing attackers to inject arbitrary shell commands through shell metacharacters.

---

## Description

PraisonAI's workflow system and command execution tools pass user-controlled input directly to `subprocess.run()` with `shell=True`, enabling command injection attacks. Input sources include:

1. YAML workflow step definitions 2. Agent configuration files (agents.yaml) 3. LLM-generated tool call parameters 4. Recipe step configurations

The `shell=True` parameter causes the shell to interpret metacharacters (`;`, `|`, `&&`, `$()`, etc.), allowing attackers to execute arbitrary commands beyond the intended operation.

---

## Affected Code

**Primary command execution (shell=True default):** ```python # code/tools/execute_command.py:155-164 def execute_command(command: str, shell: bool = True, ...): if shell: result = subprocess.run( command, # User-controlled input shell=True, # Shell interprets metacharacters cwd=work_dir, capture_output=capture_output, timeout=timeout, env=cmd_env, text=True, ) ```

**Workflow shell step execution:** ```python # cli/features/job_workflow.py:234-246 def _exec_shell(self, cmd: str, step: Dict) -> Dict: """Execute a shell command from workflow step.""" cwd = step.…

Affected: PyPI: praisonai

The `execute_command` function and workflow shell execution are exposed to user-controlled input via agent workflows, YAML definitions, and LLM-generated tool calls, allowing attackers to inject arbitrary shell commands through shell metacharacters.

---

## Description

PraisonAI's workflow system and command execution tools pass user-controlled input directly to `subprocess.run()` with `shell=True`, enabling command injection attacks. Input sources include:

1. YAML workflow step definitions 2. Agent configuration files (agents.yaml) 3. LLM-generated tool call parameters 4. Recipe step configurations

The `shell=True` parameter causes the shell to interpret metacharacters (`;`, `|`, `&&`, `$()`, etc.), allowing attackers to execute arbitrary commands beyond the intended operation.

---

## Affected Code

**Primary command execution (shell=True default):** ```python # code/tools/execute_command.py:155-164 def execute_command(command: str, shell: bool = True, ...): if shell: result = subprocess.run( command, # User-controlled input shell=True, # Shell interprets metacharacters cwd=work_dir, capture_output=capture_output, timeout=timeout, env=cmd_env, text=True, ) ```

**Workflow shell step execution:** ```python # cli/features/job_workflow.py:234-246 def _exec_shell(self, cmd: str, step: Dict) -> Dict: """Execute a shell command from workflow step.""" cwd = step…