CVE-2026-57133

CVE-2026-57133 affects the PraisonAI npm package (praisonai) versions 1.5.1 through 1.7.1 . The shell() helper in utility-tools.ts validates only the first whitespace-delimited token against a read-only command allowlist, then passes the full string to child_process.exec(). Because exec() runs th...