PT-2026-29822 · Praisonai · Praisonai

·

CVE-2026-34935

·

Published

2026-04-01

·

Updated

2026-07-24

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions PraisonAI versions 4.5.15 through 4.5.68
Description PraisonAI is a multi-agent teams system. The --mcp CLI argument is passed directly to shlex.split() and forwarded through the call chain to anyio.open process() without validation, allowlist checks, or sanitization. This allows arbitrary OS command execution as the process user. The issue resides in the MCPHandler.parse mcp command() function within src/praisonai/praisonai/cli/features/mcp.py, which fails to validate the executable or its arguments. Consequently, an attacker who can influence the MCP server configuration can execute dangerous commands using executables such as bash, python, or /bin/sh with inline code execution flags (e.g., -c or -e).
Recommendations Update PraisonAI to version 4.5.69. As a temporary mitigation, avoid using the --mcp CLI argument with untrusted or unvalidated input.

Exploit

Fix

RCE

Command Injection

OS Command Injection

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2026-34935
GHSA-9GM9-C8MQ-VQ7M
GHSA-9QHQ-V63V-FV3J
PYSEC-2026-471
PYSEC-2026-473

Affected Products

Praisonai