PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, CommandValidator in src/praisonai-ts/src/cli/features/sandbox-executor.ts validates only the first whitespace-delimited executable against allowedCommands, then SandboxExecutor passes the complete command string to sh -c. A command beginning with an allowed executable can append a non-allowlisted command through shell metacharacters, causing arbitrary commands to run with the PraisonAI process privileges. This issue is fixed in version 1.7.2.

Affected: npm: praisonai

## Summary

The published npm package `praisonai` exports `SandboxExecutor`, `CommandValidator`, and `sandboxExec` as "safe command execution with restrictions." When `allowedCommands` is configured, `CommandValidator` checks only the first whitespace-delimited token of the command string. `SandboxExecutor` then passes the entire original string to `spawn("sh", ["-c", command])`.

With a policy that allows only `echo`, this direct command is correctly rejected:

```sh cat /tmp/marker ```

but this chained command is accepted and executed:

```sh echo allowed; cat /tmp/marker ```

The shell executes `cat` even though `cat` is not allowlisted. This bypasses the command allowlist and can execute arbitrary shell commands with the PraisonAI process privileges when an application, CLI workflow, or agent pipeline exposes sandbox command execution to lower-trust users, prompts, or model output.

The PoV is deterministic and local-only. It creates and reads only a temporary marker file.

## Technical Details

In `src/praisonai-ts/src/cli/features/sandbox-executor.ts`, `CommandValidator.validate()` normalizes the command and authorizes only the first whitespace token:

```ts const normalized = command.toLowerCase().trim();

if (this.allowedCommands) { const baseCmd = normalized.split(/\s+/)[0]; if (!this.allowedCommands.includes(baseCmd)) { return { valid: false, reason: `Command '${baseCmd}' not in allowlist` }; } } ```

The denylist does not generally reject shell separato…