Executive brief
PraisonAI, a system for managing multi-agent AI teams, contains a vulnerability that allows for unauthorized command execution on the host system. By providing specially crafted input to the system's Python execution tool, an attacker can bypass security filters to run arbitrary operating system commands. This could lead to a total compromise of the server, including the theft of sensitive data or the disruption of AI operations.
Technical details
An OS command injection vulnerability exists in the `run_python()` function within `praisonai/code/tools/execute_command.py`. The function attempts to sanitize user-provided Python code by escaping backslashes and double quotes before interpolating it into a `python3 -c "<code_here>"` string. However, it fails to escape shell-specific characters such as `$()` and backticks. Because the resulting string is executed via `subprocess.run(..., shell=True)`, the shell performs command substitution on these unescaped elements before the Python interpreter is even invoked. This allows an attacker to achieve arbitrary code execution with the privileges of the process user. The vulnerability is reachable via indirect prompt injection or through the auto-generated Flask server if authentication is not explicitly configured. This issue is fixed in version 1.5.90.
Affected products
- MervinPraison PraisonAI (praisonaiagents) < 1.5.90
Timeline
- 2026-03-31: advisory: GitHub Security Advisory published
- 2026-04-03: disclosed: CVE-2026-34937 published to NVD
- 2026-04-03: patched: Vulnerability fixed in version 1.5.90