LLM Tool Injection Enables Arbitrary File Write and Command Execution

PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component due to missing path validation and command sanitization in LLM tool calls. Attackers can inject malicious prompts through the chat interface to write files to arbitrary filesystem locations and execute arbitrary shell commands with root privileges.

Casky was already ahead

This CVE exploits attack patterns that Casky's 351matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

PraisonAI versions before 4.6.78 suffer from a critical vulnerability in the AICoder component where the LLM's tool-calling capabilities lack proper input validation and sanitization. An attacker can craft malicious prompts through the chat interface that trick the AI into generating shell commands or file write operations to arbitrary filesystem locations. Because these commands execute with root privileges, an attacker gains complete system compromise—the ability to read sensitive data, modify system files, install persistence mechanisms, or pivot to other systems. Organizations deploying PraisonAI for code generation, automation, or development workflows are at immediate risk, particularly if the platform processes untrusted input or operates in environments with access to sensitive data or critical infrastructure.

Casky's 351 matched skills leverage Claude's extended reasoning to detect the attack patterns underlying this vulnerability across MITRE techniques TA0001 (Reconnaissance) and TA0007 (Discovery). Practitioners would observe findings aligned with CWE-22 path traversal patterns—such as prompts containing path traversal sequences like "../../../" or absolute paths to system directories—combined with command injection signatures in LLM outputs. Casky's skill set identifies when AI-generated tool calls lack proper escaping, contain unvalidated user input in command arguments, or attempt file operations outside expected directories. Security teams would see behavioral indicators such as unexpected shell metacharacters in sanitized inputs, file write attempts to /etc, /root, or other sensitive locations, and command structures designed to bypass basic filtering. This multi-layered detection approach helps practitioners distinguish between legitimate tool use and malicious prompt injection attempts before execution.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

351 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-61445.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2026-61445

Casky has 351 skills that investigate the attack patterns behind CVE-2026-61445. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn