# CVE-2026-34938: MervinPraison PraisonAI sandbox escape in execute_code

Source: https://junglewise.ai/threats/cve-2026-34938-mervinpraison-praisonai-sandbox-escape-in-execute-code  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-03. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-34938 · Severity: critical · CVSS 10 · Published 2026-04-03

PraisonAI is a framework for managing teams of AI agents. A security flaw in its code execution component allows an attacker to bypass built-in safety restrictions and run unauthorized commands on the underlying server. This could lead to a total system takeover, theft of sensitive data, or disruption of operations, especially in deployments where AI agents are configured to run tasks automatically without human approval.

Technologies: [Praisonaiagents](https://junglewise.ai/threats/technologies/praisonaiagents), [praisonaiagents (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonaiagents). Vendors: [Praison](https://junglewise.ai/threats/vendors/praison), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-34938 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34938 being exploited in the wild.

**How severe is CVE-2026-34938?** Critical severity, with a CVSS score of 10, published 3 April 2026.

**Which products and versions are affected?** praisonaiagents (PyPI) ECOSYSTEM:introduced=0,fixed=1.5.90.

**Is there a fix for CVE-2026-34938?** Yes. praisonaiagents (PyPI): upgrade to 1.5.90 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34938 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-34938?** Check whether you run Praisonaiagents or praisonaiagents (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- praisonaiagents (PyPI): upgrade to 1.5.90 or later

  ```sh
  pip install "praisonaiagents>=1.5.90"
  ```


## Technical details

A sandbox escape vulnerability exists in the 'execute_code' function of the praisonai-agents package. The vulnerability stems from a logic error in the '_safe_getattr' wrapper, which attempts to block access to sensitive attributes (those starting with underscores) using 'name.startswith('_')'. Because the wrapper accepts any 'str' subclass, an attacker can provide a custom string object with a malicious 'startswith' method that always returns 'False', bypassing the security check. By leveraging 'type()' (which is permitted in the sandbox) to create this subclass, an attacker can access '__subclasses__' and other internal attributes to reach the 'subprocess.Popen' class. This allows for arbitrary OS command execution with the privileges of the application process. The issue is particularly severe in 'autonomy_mode' where 'PRAISONAI_AUTO_APPROVE' is enabled by default. The vulnerability is patched in version 1.5.90.

## Affected products

- MervinPraison PraisonAI (praisonai-agents) < 1.5.90

## Identifiers

- CVE-2026-34938
- GHSA-6vh2-h83c-9294
- PYSEC-2026-484

## Timeline

- 2026-03-31: advisory: Vendor advisory published on GitHub
- 2026-04-03: disclosed: CVE published to NVD
- 2026-04-03: patched: Fix released in version 1.5.90

## References

- [https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6vh2-h83c-9294](https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6vh2-h83c-9294)

## Related threats

- [PraisonAI SearxNG URL validation bypass in search tools](https://junglewise.ai/threats/cve-2026-57143-praisonai-server-side-request-forgery-ssrf-in-searxng-search-web)
- [PraisonAI missing access control in API endpoints](https://junglewise.ai/threats/cve-2026-57118-praisonai-agentteam-launch-exposes-unauthenticated-remote-agent)
- [PraisonAI legacy SSE endpoint CORS and authentication bypass](https://junglewise.ai/threats/cve-2026-57112-praisonai-legacy-sse-endpoint-cors-and-authentication-bypass)
- [PraisonAI IMAP injection in email tools](https://junglewise.ai/threats/cve-2026-57130-praisonai-imap-injection-in-email-tools)
- [PraisonAI path traversal in file mention parsing](https://junglewise.ai/threats/cve-2026-57129-praisonai-path-traversal-in-file-mention-parsing)