CVE-2026-34937: PraisonAI RCE Vulnerability

CVE-2026-34937 Overview

PraisonAI is a multi-agent teams system that enables the coordination of multiple AI agents. A command injection vulnerability exists in versions prior to 1.5.90 where the run_python() function constructs shell command strings by interpolating user-controlled code into python3 -c "<code>" and passing it to subprocess.run(..., shell=True). The escaping logic only handles backslash (\) and double-quote (") characters, leaving $() command substitution and backtick substitutions unescaped, allowing arbitrary OS command execution before Python is even invoked.

Critical Impact

Attackers with local access can execute arbitrary operating system commands by exploiting insufficient input sanitization in shell command construction, potentially leading to complete system compromise.

Affected Products

• PraisonAI versions prior to 1.5.90

Discovery Timeline

• 2026-04-03 - CVE CVE-2026-34937 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-34937

Vulnerability Analysis

This vulnerability is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS Command Injection. The flaw exists in how PraisonAI's run_python() function handles user-supplied code before executing it via the system shell.

When user input is passed to the function, it attempts to sanitize the input by escaping certain characters before constructing a shell command in the format python3 -c "<user_code>". However, the escaping mechanism is fundamentally incomplete—it only neutralizes backslash and double-quote characters while completely ignoring shell metacharacters that enable command substitution.

This incomplete sanitization means that an attacker can embed shell command substitution sequences like $(malicious_command) or backtick-enclosed commands within their input. When the resulting string is passed to subprocess.run() with shell=True, the shell interpreter processes these substitution sequences before Python ever executes, running the attacker's arbitrary commands with the privileges of the PraisonAI process.

Root Cause

The root cause is the use of subprocess.run() with shell=True combined with inadequate input escaping. The developers recognized the need to escape certain shell-special characters but failed to account for all command injection vectors. Shell command substitution via $() syntax and backticks represents a well-known attack surface that was overlooked in the sanitization logic.

Attack Vector

The attack requires local access to the system where PraisonAI is running. An attacker who can provide input to the run_python() function can craft malicious payloads containing shell command substitution sequences. When this input reaches the vulnerable code path, the shell interprets the command substitution before Python execution, allowing the attacker to run arbitrary system commands.

For example, an attacker could inject payloads containing $(id) or $(cat /etc/passwd) which would be executed by the shell during command construction. The attacker's commands execute with the same privileges as the PraisonAI process, potentially allowing file system access, data exfiltration, or further system compromise.

Technical details and proof-of-concept information can be found in the GitHub Security Advisory.

Detection Methods for CVE-2026-34937

Indicators of Compromise

• Unusual shell commands spawned as child processes of Python/PraisonAI processes
• Process execution chains showing python3 -c commands containing shell metacharacters like $() or backticks
• Unexpected network connections or file system access originating from PraisonAI processes
• System log entries indicating command execution failures with shell substitution syntax

Detection Strategies

• Monitor process creation events for suspicious command-line arguments containing shell substitution patterns
• Implement application-level logging to capture inputs passed to the run_python() function
• Use endpoint detection tools to alert on unexpected child process spawning from PraisonAI
• Deploy file integrity monitoring on sensitive system files that could be targeted post-exploitation

Monitoring Recommendations

• Enable verbose logging for PraisonAI application to capture user input patterns
• Configure SIEM rules to detect command injection patterns in application logs
• Monitor for unusual process trees where shell commands spawn from Python interpreters
• Implement network monitoring for unexpected outbound connections from hosts running PraisonAI

How to Mitigate CVE-2026-34937

Immediate Actions Required

• Upgrade PraisonAI to version 1.5.90 or later immediately
• Audit any systems where PraisonAI was deployed to check for signs of exploitation
• Review application logs for suspicious input patterns that may indicate attempted exploitation
• Restrict local access to systems running vulnerable versions until patching is complete

Patch Information

The vulnerability has been addressed in PraisonAI version 1.5.90. Users should upgrade to this version or later to remediate the command injection vulnerability. The fix properly sanitizes user input to prevent shell metacharacter interpretation.

For detailed patch information, see the GitHub Security Advisory.

Workarounds

• Restrict access to PraisonAI functionality to trusted users only until patching is possible
• Implement network segmentation to limit the blast radius if exploitation occurs
• Deploy application-layer input filtering to block shell metacharacters before they reach the vulnerable function
• Consider running PraisonAI in a containerized or sandboxed environment to limit the impact of command execution

# Upgrade PraisonAI to patched version
pip install --upgrade praisonai>=1.5.90

# Verify installed version
pip show praisonai | grep Version