CVE-2026-34935: PraisonAI RCE Vulnerability

CVE-2026-34935 Overview

A critical command injection vulnerability exists in PraisonAI, a multi-agent teams system, where the --mcp CLI argument is passed directly to shlex.split() and forwarded through the call chain to anyio.open_process() without any validation, allowlist check, or sanitization. This flaw allows attackers to execute arbitrary OS commands as the process user, potentially leading to complete system compromise.

Critical Impact
Unauthenticated attackers can execute arbitrary operating system commands with the privileges of the PraisonAI process, leading to full system compromise, data exfiltration, and lateral movement within affected environments.

Affected Products

PraisonAI versions 4.5.15 through 4.5.68
praisonaiagents package versions 1.5.15 through 1.5.68
Systems running PraisonAI with MCP functionality enabled

Discovery Timeline

2026-04-03 - CVE-2026-34935 published to NVD
2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-34935

Vulnerability Analysis

This vulnerability (CWE-78: Improper Neutralization of Special Elements used in an OS Command) allows remote attackers to inject and execute arbitrary operating system commands through the --mcp command-line argument. The attack requires no authentication or user interaction, and can be executed remotely over the network.

The vulnerability arises from a complete lack of input validation in the MCP (Model Context Protocol) handling chain. User-controlled input from the --mcp CLI argument flows directly into command execution functions without any security controls, creating a classic command injection scenario.

Root Cause

The root cause is the absence of input validation, sanitization, or allowlist checking on the --mcp CLI argument before it is processed. The argument value is passed directly to shlex.split() for shell-style parsing and then forwarded to anyio.open_process(), which executes the resulting command. This design allows attackers to inject shell metacharacters and additional commands that will be executed with the same privileges as the PraisonAI process.

Attack Vector

The attack vector is network-based with low complexity. An attacker can craft malicious input for the --mcp argument containing shell metacharacters (such as ;, |, &&, or backticks) followed by arbitrary commands. When PraisonAI processes this input, the injected commands are executed on the underlying operating system.

For example, an attacker could inject commands to:

Establish reverse shells for persistent access
Exfiltrate sensitive data and credentials
Install malware or cryptocurrency miners
Pivot to other systems on the network

The security patch implements command validation in the MCPHandler class. The fix was introduced in version 4.5.69 (praisonaiagents 1.5.69):

text

 
 [project]
 name = "praisonaiagents"
-version = "1.5.68"
+version = "1.5.69"
 description = "Praison AI agents for completing complex tasks with Self Reflection Agents"
 readme = "README.md"
 requires-python = ">=3.10"

Source: GitHub Commit Reference

Detection Methods for CVE-2026-34935

Indicators of Compromise

Unusual process spawning from PraisonAI or Python processes with unexpected command-line arguments
Network connections to unknown external hosts originating from PraisonAI processes
Unexpected shell commands in process audit logs associated with PraisonAI execution
File system modifications or new files created in unusual locations by PraisonAI process user

Detection Strategies

Monitor command-line arguments passed to PraisonAI processes, specifically the --mcp parameter for shell metacharacters (;, |, &&, $(), backticks)
Implement process monitoring to detect child processes spawned by PraisonAI with suspicious command patterns
Deploy network monitoring to identify outbound connections from PraisonAI processes to unexpected destinations
Enable Python application logging to capture MCP handler invocations and parameter values

Monitoring Recommendations

Configure SIEM rules to alert on command injection patterns in PraisonAI-related logs
Implement file integrity monitoring on systems running PraisonAI to detect unauthorized changes
Set up behavioral analysis to identify anomalous process trees originating from PraisonAI
Monitor for reverse shell indicators and unusual network traffic patterns from affected systems

How to Mitigate CVE-2026-34935

Immediate Actions Required

Upgrade PraisonAI to version 4.5.69 or later immediately
Audit systems for signs of compromise if running vulnerable versions
Review process logs for any suspicious command execution patterns
Restrict network access to systems running vulnerable PraisonAI versions until patched

Patch Information

The vulnerability has been patched in PraisonAI version 4.5.69 and praisonaiagents version 1.5.69. The fix implements command validation in the MCPHandler class to prevent arbitrary command injection through the --mcp CLI argument.

For patch details, refer to:

Workarounds

Disable or avoid using the --mcp CLI functionality until the patch can be applied
Implement network segmentation to isolate systems running PraisonAI from sensitive resources
Run PraisonAI with minimal privileges using a dedicated service account with restricted permissions
Deploy web application firewall (WAF) rules to filter requests containing shell metacharacters destined for PraisonAI interfaces

bash

# Upgrade PraisonAI to patched version
pip install --upgrade praisonai>=4.5.69
pip install --upgrade praisonaiagents>=1.5.69

# Verify installed version
pip show praisonai | grep Version
pip show praisonaiagents | grep Version