CyberRota Analysis
AI-GeneratedPraisonAI versions prior to 4.6.78 are susceptible to an allowlist bypass vulnerability that enables attackers to execute restricted shell commands through the find command's built-in actions, such as -exec and -delete. This flaw could lead to unauthorized access to sensitive files, deletion of critical data, or execution of unapproved binaries, posing a significant risk to system integrity. Organizations using affected versions should prioritize patching to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell command execution that allows attackers to execute restricted commands via find's built-in -exec, -execdir, and -delete actions. Attackers can craft find commands with these built-in actions to read blocked files, delete files, or execute non-allowlisted binaries without triggering shell metacharacter filters.