GHSA-5R6C-GJ4G-R697 PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend

Summary SecurityPolicy in praisonaiagents/sandbox/config.py is a documented configuration data class with fields for allowsubprocess, allowedpaths, blockedpaths, allowedcommands, blockedcommands, allowedimports, and blockedimports. Its strict classmethod is explicitly described as creating "a...

PT-2026-108708

Name of the Vulnerable Software and Affected Versions PraisonAI affected versions not specified Description The plugin manager loads and executes arbitrary .py files from the .praisonai/plugins/ directories located at both the project level and the user home. This occurs through the use of...