What is the CVSS score of CVE-2026-34935?

CVE-2026-34935 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Python are affected by CVE-2026-34935?

PraisonAI versions before 4.5.69 contain a critical remote command execution vulnerability in the `--mcp` CLI argument that allows unauthenticated attackers to execute arbitrary operating system…. A patch is available.

Is there a public PoC exploit available for CVE-2026-34935?

Yes, a public proof-of-concept exploit is available for CVE-2026-34935. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-34935?

Within 24 hours: Identify all systems running PraisonAI and determine currently installed versions using `pip show praisonai`. Within 7 days: Upgrade all affected instances to PraisonAI version 4.5.69 or later using `pip install --upgrade praisonai>=4.5.69` and validate the upgrade with `pip show praisonai`. Within 30 days: Conduct a security audit of PraisonAI deployments to ensure the `--mcp` argument is never populated from untrusted sources and implement network segmentation if CLI interfaces are exposed.

Python CVE-2026-34935

CRITICAL

OS Command Injection (CWE-78)

2026-04-01 https://github.com/MervinPraison/PraisonAI

GHSA-9gm9-c8mq-vq7m

Command Injection Python

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

Analysis Generated

Apr 02, 2026 - 00:15 vuln.today

Patch released

Apr 02, 2026 - 00:15 nvd

Patch available

CVE Published

Apr 01, 2026 - 23:20 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

Summary

The --mcp CLI argument is passed directly to shlex.split() and forwarded through the call chain to anyio.open_process() with no validation, allowlist check, or sanitization at any hop, allowing arbitrary OS command execution as the process user.

Details

cli/features/mcp.py:61 (source) -> praisonaiagents/mcp/mcp.py:345 (hop) -> mcp/client/stdio/__init__.py:253 (sink)

python

# source
parts = shlex.split(command)
# hop
cmd, args, env = self.parse_mcp_command(command, env_vars)
self.server_params = StdioServerParameters(command=cmd, args=arguments)
# sink
process = await anyio.open_process([command, *args])

Fixed in commit 47bff65413beaa3c21bf633c1fae4e684348368c (v4.5.69) by introducing a command allowlist:

python

ALLOWED_COMMANDS = {"npx", "uvx", "node", "python"}
if cmd not in ALLOWED_COMMANDS:
    raise ValueError(f"Disallowed command: {cmd}")

PoC

python

# tested on: praisonai==4.5.48
# install: pip install praisonai==4.5.48
# run: praisonai --mcp "bash -c 'id > /tmp/pwned'"
# verify: cat /tmp/pwned
# expected output: uid=1000(...) gid=1000(...) groups=1000(...)

Impact

Any deployment where the --mcp argument is influenced by untrusted input is exposed to full OS command execution as the process user. No authentication is required.

AnalysisAI

Arbitrary OS command execution in PraisonAI (Python package) versions prior to 4.5.69 allows remote unauthenticated attackers to execute commands as the process user via the unsanitized --mcp CLI argument. The vulnerability stems from passing user-controlled input directly to shlex.split() and anyio.open_process() without validation. CVSS 9.8 (Critical). Vendor-released patch available in version 4.5.69 (commit 47bff65). No public exploit code independently confirmed beyond the GitHub advisory PoC, and not listed in CISA KEV at time of analysis.

Technical ContextAI

PraisonAI is a Python-based AI agent framework distributed via PyPI. The vulnerability exists in the Model Context Protocol (MCP) integration path spanning three modules: cli/features/mcp.py (entry point), praisonaiagents/mcp/mcp.py (parameter forwarding), and mcp/client/stdio/__init__.py (process execution sink). The --mcp argument accepts a command string intended for launching MCP server processes. The implementation uses shlex.split() to tokenize the command, but critically fails to validate the resulting command name or arguments before passing them to anyio.open_process(), a wrapper around subprocess execution. This creates a classic command injection vulnerability (CWE-78) where shell metacharacters and arbitrary commands can be injected. The attack surface is any deployment where the CLI is exposed to untrusted input sources, including web APIs wrapping the CLI, containerized services, or scheduled tasks processing external data. The affected package identifier is pkg:pip/praisonai, impacting all versions before the 4.5.69 security release.

RemediationAI

Immediately upgrade to PraisonAI version 4.5.69 or later, which introduces command allowlist validation restricting --mcp to approved executables (npx, uvx, node, python) as implemented in commit 47bff65413beaa3c21bf633c1fae4e684348368c. Verify the fix is present by checking that ALLOWED_COMMANDS validation exists in praisonaiagents/mcp/mcp.py. For environments unable to upgrade immediately, implement defense-in-depth controls: remove or disable the --mcp CLI argument if MCP integration is not required, restrict CLI execution to trusted administrators only, run PraisonAI processes under least-privilege user accounts with no shell access, deploy in isolated containers with restricted process execution capabilities (seccomp/AppArmor profiles blocking exec syscalls), and implement input validation at the application layer before any CLI invocation. Review logs for suspicious --mcp usage patterns including shell metacharacters (backticks, semicolons, pipes) or unexpected command names. Patch deployment advisory and commit details at https://github.com/MervinPraison/PraisonAI/commit/47bff65413beaa3c21bf633c1fae4e684348368c.