PraisonAI Prompt Injection Block Threshold Misconfiguration

Technical Analysis

The vulnerability stems from a default configuration flaw in PraisonAI's built-in prompt injection detector, where the enforcement threshold is set to CRITICAL rather than a more conservative level. Attacker-supplied input containing instruction-override or financial-manipulation patterns is classified as HIGH severity by the detector, but because the block gate only triggers at CRITICAL, the malicious payload reaches the underlying LLM and executes as if it were trusted instruction. The entry point is any user or upstream data source feeding text into the agent's prompt pipeline (chat input, retrieved documents, tool outputs). Successful exploitation grants the attacker system prompt disclosure and the ability to invoke tools outside the intended task scope, effectively crossing the boundary from untrusted input into privileged agent actions without requiring multi-stage or multi-vector attacks.

Affected Systems

PraisonAI

Detection Signatures

• Log entries showing prompt injection detections classified as HIGH severity with action=logged/allowed rather than blocked
• Repeated attempts containing instruction-override phrasing (e.g., 'ignore previous instructions', 'disregard your rules') that correlate with HIGH-severity log tags but no block event
• Unexpected tool invocation immediately following an inbound message flagged at HIGH severity
• System prompt content appearing in model output logs following a flagged HIGH-severity input
• Configuration audit showing block_threshold=CRITICAL in PraisonAI guardrail settings

Remediation Steps

1. 1

   Upgrade PraisonAI

   Update to PraisonAI version 4.6.78 or later, which addresses the default threshold misconfiguration.

2. 2

   Lower block threshold

   Explicitly configure the prompt injection guardrail to block at HIGH severity (or lower) rather than relying on the CRITICAL-only default.

3. 3

   Audit logs for prior exposure

   Review historical logs for HIGH-severity detections that were allowed through, and assess whether system prompt leakage or unauthorized tool calls occurred.

4. 4

   Add defense-in-depth output filtering

   Implement independent output-side checks (e.g., system prompt leakage detection, tool-call allowlists) that do not solely rely on the input-side injection classifier.

5. 5

   Least-privilege tool access

   Restrict which tools an agent can invoke without additional confirmation, limiting the blast radius if an injection bypasses detection.