PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, CommandValidator in src/praisonai-ts/src/cli/features/sandbox-executor.ts validates only the first whitespace-delimited executable against allowedCommands, then SandboxExecutor passes the complete command string to sh -c. A command beginning with an allowed executable can append a non-allowlisted command through shell metacharacters, causing arbitrary commands to run with the PraisonAI process privileges. This issue is fixed in ver

CVE-2026-57136 affects PraisonAI, a multi-agent teams system, in versions 1.2.3 through 1.7.2. The vulnerability exists in the CommandValidator component within sandbox-executor.ts, which only validates the first whitespace-delimited executable against an allowlist. The SandboxExecutor then passes the full command string to 'sh -c', allowing attackers to append arbitrary commands using shell metacharacters after an allowed executable. This constitutes a command injection vulnerability enabling arbitrary code execution with PraisonAI process-level privileges. The flaw is located in the TypeScript CLI feature sandbox executor. No authentication bypass is needed if an attacker can influence command inputs. The issue has been patched in version 1.7.2. A corresponding GitHub commit and security advisory (GHSA-vjv9-7m7j-h833) have been published.