CVE-2026-34938

CRITICAL SEVERITY

CVSS Score & Metrics

Base Score

10.0 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H                                    

Vulnerability Description

PraisonAI is a multi-agent teams system. Prior to version 1.5.90, execute_code() in praisonai-agents runs attacker-controlled Python inside a three-layer sandbox that can be fully bypassed by passing a str subclass with an overridden startswith() method to the _safe_getattr wrapper, achieving arbitrary OS command execution on the host. This issue has been patched in version 1.5.90.

Vulnerability Details

Published Date

April 01, 2026

Last Modified

April 07, 2026

CWE ID

CWE-693

Source

GitHub

Vendor

pip

Product

praisonaiagents

External References

https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6vh2-h83c-9294
https://github.com/advisories/GHSA-6vh2-h83c-9294

CVE-2026-34938

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment