npm PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining
Summary
The published npm package praisonai ships dist/tools/utility-tools.js, which exports a shell(command) helper described in source as:
```text
Execute shell command (safe version - read-only commands)
```
The helper attempts to enforce a safe read-only command allowlist by checking only the first whitespace-delimited token:
```ts
const safeCommands = ['ls', 'cat', 'head', 'tail', 'wc', 'grep', 'find', 'echo', 'date', 'pwd', 'which'];
const firstWord = command.split(/\s+/)[0];
if (!safeCommands.includes(firstWord)) {
return { success: false, error: Command not allowed: ${firstWord} };
}
```
It then passes the entire original string to Node child_process.exec():
```ts
const { stdout, stderr } = await execAsync(command, { timeout: 5000 });
```
Because exec() runs the command through a shell, a command string that starts with an allowed command can append a second non-allowlisted command with shell metacharacters. For example, direct printf <marker> is rejected, but echo ok; printf <marker> is accepted and executes printf.
This bypasses the helper's safe-command policy and allows arbitrary shell commands to run with the PraisonAI process privileges when an application, agent, or integration exposes this helper to lower-trust users, prompts, model output, or plugin/tool input.
The PoV is deterministic and local-only. It installs only the npm package, runs harmless marker commands, and does not contact any live service after installation.
Technical Details
utility-tools.shell() authorizes one token but executes the full shell string.
Source-head implementation:
```ts
export async function shell(command: string): Promise<ToolResult<string>> {
// Only allow safe read-only commands
const safeCommands = ['ls', 'cat', 'head', 'tail', 'wc', 'grep', 'find', 'echo', 'date', 'pwd', 'which'];
const firstWord = command.split(/\s+/)[0];
if (!safeCommands.includes(firstWord)) {
return { success: false, error: Command not allowed: ${firstWord} };
}
try {
const { exec } = await import('child_process');
const { promisify } = await import('util');
const execAsync = promisify(exec);
const { stdout, stderr } = await execAsync(command, { timeout: 5000 });
return { success: true, data: stdout || stderr };
} catch (error: any) {
return { success: false, error: error.message ?? String(error) };
}
}
```
The published npm:[email protected] dist file preserves the same behavior:
exports.shell = shellconst firstWord = command.split(/\s+/)[0]if (!safeCommands.includes(firstWord)) ...const { stdout, stderr } = await execAsync(command, { timeout: 5000 })
This creates a policy/parser differential: PraisonAI checks only the first token, while the shell parses the full string as a script.
Why This Is Not Intended Behavior
The helper is explicitly documented in code as a "safe version" for read-only commands and contains an allowlist of specific safe commands. The control test proves that non-allowlisted commands are intended to be blocked: direct printf <marker> returns Command not allowed: printf.
The same helper accepting echo ok; printf <marker> is therefore a bypass of the intended safe-command boundary, not merely a permissive command runner.
This is also consistent with Node's own guidance for shell execution: child_process.exec() runs through a shell, and shell metacharacters can change which commands execute. The fix should make PraisonAI's authorization boundary match what is actually executed.
PoV
Run from a local reproduction checkout:
```bash
node poc/pov_poc.js 1.7.1
```
Observed output summary from evidence/pov-npm-1.7.1.json:
```json
{
"package": "npm:praisonai",
"version": "1.7.1",
"installedPackageVersion": "1.7.1",
"commands": {
"directDisallowedCommand": "printf poc.7.1",
"benignAllowedCommand": "echo poc",
"chainedBypassCommand": "echo poc; printf poc.7.1"
},
"controls": {
"directDisallowedRejected": true,
"benignAllowedAccepted": true,
"patchedControlRejectsChainedShell": true
},
"observed": {
"directDisallowed": {
"success": false,
"error": "Command not allowed: printf"
},
"chainedBypass": {
"success": true,
"data": "poc\npoc.7.1"
}
},
"vulnerable": true
}
```
Interpretation:
- Direct
printf <marker> is rejected because printf is not in safeCommands. - Benign
echo ... is accepted. echo ...; printf <marker> is accepted because the first token is echo.- The shell then executes the non-allowlisted
printf command. - A patched-control validator that rejects shell metacharacters before execution blocks the chained command while still allowing benign
echo.
The PoV uses only harmless marker output. It does not read system files, leak environment variables,
