CVE-2026-34937: PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-03 · updated 2026-07-24
Weakness: CWE-78

Description

PraisonAI is a multi-agent teams system. Prior to version 1.5.90, run_python() in praisonai constructs a shell command string by interpolating user-controlled code into python3 -c "<code>" and passing it to subprocess.run(..., shell=True). The escaping logic only handles \ and ", leaving $() and backtick substitutions unescaped, allowing arbitrary OS command execution before Python is invoked. This issue has been patched in version 1.5.90.

Affected products

MervinPraison praisonaiagents: before 1.5.90 — fixed in 1.5.90

How to fix

Upgrade to a fixed version: MervinPraison praisonaiagents 1.5.90. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-34937 or the next vulnerability affects your stack