GHSA-wrw8-384c-cg76
Duplicate Advisory: PraisonAI: Shell command allowlist bypass via find -exec built-in action
Summary
### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-cv3g-hj65-pcfh. This link is maintained to preserve external references. ### Original Description PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell command execution that allows attackers to execute restricted commands via find's built-in -exec, -execdir, and -delete actions. Attackers can craft find commands with these built-in actions to read blocked files, delete files, or execute non-allowlisted binaries without triggering shell metacharacter filters.
Affected packages
| Ecosystem | Package | Affected versions | Fixed versions |
|---|---|---|---|
| PyPI | PraisonAI | — | — |
Remediation: No patched version is listed by GitHub.
References
Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.