PT-2026-29831 · Praisonai · Praisonai

Yerang30 · Published 2026-04-01 · Updated 2026-04-04 · CVE-2026-34955

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.5.97

Description PraisonAI's SubprocessSandbox in all modes (BASIC, STRICT, NETWORK ISOLATED) utilizes subprocess.run() with shell=True and relies on string-pattern matching for command blocking. The blocklist does not include sh or bash executables, enabling sandbox escape in STRICT mode via sh -c '<command>'. This allows attackers to bypass OS-level isolation and potentially access the network, filesystem, and cloud metadata services, especially when combined with agent prompt injection. The vulnerable code is located in sandbox executor.py, specifically lines 179 and 326. The issue stems from the lack of blocking sh and bash in the blocked commands list and the use of shell=True which spawns /bin/sh.

Recommendations Update to version 4.5.97 or later to address the vulnerability. As a temporary workaround, avoid using the --sandbox strict option. Consider using shlex.split() with shell=False in the subprocess.run() call to prevent shell injection.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-34955

GHSA-R4F2-3M54-PP7Q

Affected Products

Praisonai

References · 7

• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-r4f2-3m54-pp7q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34955 · Security Note
• https://osv.dev/vulnerability/GHSA-r4f2-3m54-pp7q · Vendor Advisory
• https://github.com/MervinPraison/PraisonAI · Note
• https://reddit.com/r/pwnhub/comments/1scduwo/severe_vulnerability_discovered_in_praisonai · Reddit Post
• https://twitter.com/cyberbivash/status/2040259532778013148 · Twitter Post
• https://twitter.com/CveFindCom/status/2040213453546131500 · Twitter Post