CVE-2026-34938

PraisonAI is a multi-agent teams system. Prior to version 1.5.90, execute_code() in praisonai-agents runs attacker-controlled Python inside a three-layer sandbox that can be fully bypassed by passing a str subclass with an overridden startswith() method to the _safe_getattr wrapper, achieving arbitrary OS command execution on the host. This issue has been patched in version 1.5.90.

CVSS v3 10.0 CRITICAL

10.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6vh2-h83c-9294	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:praison:praisonaiagents:*:*:*:*:*:*:*:*

History

24 Jul 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) PraisonAI es un sistema de equipos multiagente. Antes de la versión 1.5.90, execute_code() en praisonai-agents ejecuta Python controlado por el atacante dentro de una sandbox de tres capas que puede ser completamente eludida pasando una subclase de str con un método startswith() sobrescrito al wrapper _safe_getattr, logrando la ejecución arbitraria de comandos del sistema operativo en el host. Este problema ha sido parcheado en la versión 1.5.90.

14 Apr 2026, 18:07

Type	Values Removed	Values Added
CPE		cpe:2.3:a:praison:praisonaiagents::::::::
References	~~() https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6vh2-h83c-9294 -~~	() https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6vh2-h83c-9294 - Exploit, Vendor Advisory
First Time		Praison praisonaiagents Praison

03 Apr 2026, 23:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-04-03 23:17

Updated : 2026-07-24 22:10

NVD link : CVE-2026-34938

Mitre link : CVE-2026-34938

CVE.ORG link : CVE-2026-34938

JSON object : View

Products Affected

praison

praisonaiagents

CWE

CWE-693

Protection Mechanism Failure

{"id": "CVE-2026-34938", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34938", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-06T13:23:32.754263Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "MervinPraison", "product": "PraisonAI", "versions": [{"status": "affected", "version": "< 1.5.90"}]}]}], "published": "2026-04-03T23:17:06.170", "references": [{"url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6vh2-h83c-9294", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-693"}]}], "descriptions": [{"lang": "en", "value": "PraisonAI is a multi-agent teams system. Prior to version 1.5.90, execute_code() in praisonai-agents runs attacker-controlled Python inside a three-layer sandbox that can be fully bypassed by passing a str subclass with an overridden startswith() method to the _safe_getattr wrapper, achieving arbitrary OS command execution on the host. This issue has been patched in version 1.5.90."}, {"lang": "es", "value": "PraisonAI es un sistema de equipos multiagente. Antes de la versi\u00f3n 1.5.90, execute_code() en praisonai-agents ejecuta Python controlado por el atacante dentro de una sandbox de tres capas que puede ser completamente eludida pasando una subclase de str con un m\u00e9todo startswith() sobrescrito al wrapper _safe_getattr, logrando la ejecuci\u00f3n arbitraria de comandos del sistema operativo en el host. Este problema ha sido parcheado en la versi\u00f3n 1.5.90."}], "lastModified": "2026-07-24T22:10:00.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:praison:praisonaiagents:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0CECD474-C348-4AD9-B570-42895741C580", "versionEndExcluding": "1.5.90"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}