CVE-2026-34937: MervinPraison PraisonAI OS command injection in run_python

CVE-2026-34937 · Severity: high · CVSS 7.8 · Published 2026-04-03

PraisonAI, a system for managing multi-agent AI teams, contains a vulnerability that allows for unauthorized command execution on the host system. By providing specially crafted input to the system's Python execution tool, an attacker can bypass security filters to run arbitrary operating system commands. This could lead to a total compromise of the server, including the theft of sensitive data or the disruption of AI operations.

Technologies: Praisonaiagents, praisonaiagents (PyPI). Vendors: Praison, PyPI.

Quick answers

Is CVE-2026-34937 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34937 being exploited in the wild.
How severe is CVE-2026-34937?
High severity, with a CVSS score of 7.8, published 3 April 2026.
Which products and versions are affected?
praisonaiagents (PyPI) ECOSYSTEM:introduced=0,fixed=1.5.90.
Is there a fix for CVE-2026-34937?
Yes. praisonaiagents (PyPI): upgrade to 1.5.90 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34937 attacked?
It is attacked with local access or over the network, in a software library.
Am I affected by CVE-2026-34937?
Check whether you run Praisonaiagents or praisonaiagents (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • praisonaiagents (PyPI): upgrade to 1.5.90 or later
    pip install "praisonaiagents>=1.5.90"

Technical details

An OS command injection vulnerability exists in the `run_python()` function within `praisonai/code/tools/execute_command.py`. The function attempts to sanitize user-provided Python code by escaping backslashes and double quotes before interpolating it into a `python3 -c "<code_here>"` string. However, it fails to escape shell-specific characters such as `$()` and backticks. Because the resulting string is executed via `subprocess.run(..., shell=True)`, the shell performs command substitution on these unescaped elements before the Python interpreter is even invoked. This allows an attacker to achieve arbitrary code execution with the privileges of the process user. The vulnerability is reachable via indirect prompt injection or through the auto-generated Flask server if authentication is not explicitly configured. This issue is fixed in version 1.5.90.

Affected products

  • MervinPraison PraisonAI (praisonaiagents) < 1.5.90

Identifiers

  • CVE-2026-34937
  • GHSA-w37c-qqfp-c67f
  • PYSEC-2026-2954

Timeline

  • 2026-03-31: advisory: GitHub Security Advisory published
  • 2026-04-03: disclosed: CVE-2026-34937 published to NVD
  • 2026-04-03: patched: Vulnerability fixed in version 1.5.90

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.