Описание
PraisonAI Vulnerable Untrusted Remote Template Code Execution
PraisonAI treats remotely fetched template files as trusted executable code without integrity verification, origin validation, or user confirmation, enabling supply chain attacks through malicious templates.
Description
When a user installs a template from a remote source (e.g., GitHub), PraisonAI downloads Python files (including tools.py) to a local cache without:
- Code signing verification
- Integrity checksum validation
- Dangerous code pattern scanning
- User confirmation before execution
When the template is subsequently used, the cached tools.py is automatically loaded and executed via exec_module(), granting the template's code full access to the user's environment, filesystem, and network.
Affected Code
Template download (no verification):
Automatic execution (no confirmation):
Trust Boundary Violation
PraisonAI breaks the expected security boundary between:
- Data: Template metadata, YAML configuration (should be safe to load)
- Code: Python files from remote sources (should require verification)
By automatically executing downloaded Python code, the tool treats untrusted remote content as implicitly trusted, violating standard supply chain security practices.
Proof of Concept
Attacker creates seemingly legitimate template:
Victim workflow:
What the user sees:
What actually happened:
- API keys and tokens stolen
- No error messages, no security warnings
- Malicious code ran with user's full privileges
Attack Scenarios
Scenario 1: Template Registry Poisoning
Attacker publishes popular-looking template. Users searching for "productivity" or "research" tools find and install it. Each installation compromises the user's environment.
Scenario 2: Compromised Maintainer Account
Legitimate template maintainer's GitHub account is compromised. Malicious code added to existing popular template affects all users on next update.
Scenario 3: Typosquatting
Template named praisonai-tools-official mimics official templates. Users mistype and install malicious version.
Impact
This vulnerability allows execution of untrusted code from remote templates, leading to potential compromise of the user’s environment.
An attacker can:
- Access sensitive data (API keys, tokens, credentials)
- Execute arbitrary commands with user privileges
- Establish persistence or backdoors on the system
This is particularly dangerous in:
- CI/CD pipelines
- Shared development environments
- Systems running untrusted or third-party templates
Successful exploitation can result in data theft, unauthorized access to external services, and full system compromise.
Remediation
Immediate
-
Verify template integrity Ensure downloaded templates are validated (e.g., checksum or signature) before use.
-
Require user confirmation Prompt users before executing code from remote templates.
-
Avoid automatic execution Do not execute
tools.pyunless explicitly enabled by the user.
Short-term
-
Sandbox execution Run template code in an isolated environment with restricted access.
-
Trusted sources only Allow templates only from verified or trusted publishers.
Reporter: Lakshmikanthan K (letchupkt)
Пакеты
PraisonAI
< 4.5.128
4.5.128
Связанные уязвимости
PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI treats remotely fetched template files as trusted executable code without integrity verification, origin validation, or user confirmation, enabling supply chain attacks through malicious templates. This vulnerability is fixed in 4.5.128.