What is the CVSS score of CVE-2026-34955?

CVE-2026-34955 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Python are affected by CVE-2026-34955?

PraisonAI's SubprocessSandbox contains a command injection vulnerability (CVE-2026-34955, CVSS 8.8) that allows authenticated local users to execute arbitrary operating system commands by bypassing…. A patch is available.

How to fix or mitigate CVE-2026-34955?

Within 24 hours: inventory all PraisonAI deployments and identify systems using SubprocessSandbox functionality; immediately restrict local access to affected systems and disable sandbox features if operationally feasible. Within 7 days: isolate PraisonAI instances from production networks; implement network segmentation to limit lateral movement from compromised systems. Within 30 days: monitor PraisonAI's release channels for patched versions and coordinate testing in isolated environments before production deployment; evaluate alternative sandbox solutions or restricted execution frameworks as interim replacements.

Python CVE-2026-34955

HIGH

OS Command Injection (CWE-78)

2026-04-01 https://github.com/MervinPraison/PraisonAI

GHSA-r4f2-3m54-pp7q

Command Injection Python

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 02, 2026 - 14:30 nvd

Patch available

Analysis Generated

Apr 02, 2026 - 00:15 vuln.today

CVE Published

Apr 01, 2026 - 23:26 nvd

HIGH 8.8

DescriptionGitHub Advisory

Summary

SubprocessSandbox in all modes (BASIC, STRICT, NETWORK_ISOLATED) calls subprocess.run() with shell=True and relies solely on string-pattern matching to block dangerous commands. The blocklist does not include sh or bash as standalone executables, allowing trivial sandbox escape in STRICT mode via sh -c '<command>'.

Details

sandbox_executor.py:179 (source) -> sandbox_executor.py:326 (sink)

python

# source -- string-pattern blocklist, sh and bash not in blocked_commands
cmd_name = Path(parts[0]).name
if cmd_name in self.policy.blocked_commands:
# sh, bash not blocked
    raise SecurityError(...)
dangerous_patterns = [
    ("| sh",   ...),
# requires space -- "id|bash" evades this
    ("| bash", ...),
# requires space
]
# sink -- shell=True spawns /bin/sh regardless of sandbox mode
result = subprocess.run(
    command,
    shell=True,
    ...
)

PoC

python

# tested on: praisonai==4.5.87 (source install)
# install: pip install -e src/praisonai
import sys
sys.path.insert(0, 'src/praisonai')
from praisonai.cli.features.sandbox_executor import SubprocessSandbox, SandboxPolicy, SandboxMode

policy = SandboxPolicy.for_mode(SandboxMode.STRICT)
sandbox = SubprocessSandbox(policy=policy)

result = sandbox.execute("sh -c 'id'")
print(result.stdout)
# expected output: uid=1000(narey) gid=1000(narey) groups=1000(narey)...

Impact

Users who deploy with --sandbox strict have no meaningful OS-level isolation. Any command blocked by the policy (curl, wget, nc, ssh) is trivially reachable via sh -c '<blocked_command>'. Combined with agent prompt injection, an attacker can escape the sandbox and reach the network, filesystem, and cloud metadata services.

Suggested Fix

python

import shlex

result = subprocess.run(
    shlex.split(command),
    shell=False,
    cwd=cwd,
    env=env,
    capture_output=capture_output,
    text=True,
    timeout=timeout
)

AnalysisAI

Command injection in PraisonAI's SubprocessSandbox allows authenticated local users to bypass all sandbox modes (BASIC, STRICT, NETWORK_ISOLATED) and execute arbitrary OS commands. The vulnerability stems from shell=True usage combined with inadequate blocklist filtering that omits 'sh' and 'bash' executables, enabling trivial escape via 'sh -c' wrapper. CVSS 8.8 (High) reflects scope change and complete CIA triad compromise. No active exploitation confirmed (not in CISA KEV), but GitHub advisor

Technical ContextAI

PraisonAI (pkg:pip/praisonai) implements a Python-based subprocess sandbox intended to restrict command execution in AI agent environments. The root cause is CWE-78 (OS Command Injection) manifesting through unsafe subprocess invocation patterns. The code calls subprocess.run() with shell=True, which spawns /bin/sh to interpret the command string, then attempts security enforcement via string-pattern matching against a blocklist. The blocklist checks Path(parts[0]).name against policy.blocked_commands and scans for patterns like '| sh' and '| bash' (requiring whitespace delimiters). However, standalone 'sh' and 'bash' executables are not blocked, and the space-dependent regex fails against compact syntax like 'id|bash'. This creates a trivial bypass: wrapping any blocked command in 'sh -c' causes the policy check to see only 'sh' (not blocked), while the shell interpreter executes the wrapped payload with full privileges. The vulnerability exists across all three sandbox modes (BASIC/STRICT/NETWORK_ISOLATED), negating the security model entirely. The shell=True parameter is the critical enabler, as it transforms a Python string into a Bourne shell command with full metacharacter interpretation.

RemediationAI

Upgrade to a patched version of PraisonAI once available from the upstream repository at https://github.com/MervinPraison/PraisonAI. Monitor the GitHub security advisory at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-r4f2-3m54-pp7q for release announcements. The recommended code-level fix is to replace subprocess.run(command, shell=True, ...) with subprocess.run(shlex.split(command), shell=False, ...) to disable shell interpretation and prevent metacharacter injection. Until a vendor patch is released, implement compensating controls: disable sandbox mode entirely and rely on OS-level isolation (containers, VMs, seccomp-bpf, or AppArmor/SELinux profiles), restrict PraisonAI to trusted prompts only with no user-supplied tool definitions, or fork the repository and apply the shlex.split patch manually. Do not rely on adding 'sh' and 'bash' to the blocklist as a workaround - the underlying shell=True pattern remains exploitable through other interpreters (python -c, perl -e, etc). Network segmentation should be enforced at infrastructure level to prevent exfiltration even if sandbox escape occurs.