CVE-2026-34955 MervinPraison CVE debrief

Who should care

Users of PraisonAI versions prior to 4.5.97 should be aware of this vulnerability and take immediate action to update their installations. The vulnerability's high CVSS score of 8.8 indicates its severity, and the fact that it is exploitable in STRICT mode, which is supposed to provide a higher level of security, makes it particularly concerning for operators, platforms, vulnerability management teams, and security teams.

Technical summary

The SubprocessSandbox feature in PraisonAI, prior to version 4.5.97, is vulnerable to a sandbox escape attack. This occurs because subprocess.run() is called with shell=True, and the blocklist for dangerous commands does not include sh or bash as standalone executables. Consequently, an attacker can exploit this vulnerability in STRICT mode by using a command like sh -c '<command>'. The CVSS vector for this vulnerability is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating a high level of severity. The vulnerability is described as CWE-78.

Defensive priority

High

Recommended defensive actions

• Update PraisonAI to version 4.5.97 or later
• Review and restrict usage of SubprocessSandbox in STRICT mode
• Implement additional monitoring and logging to detect potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-04-04T00:16:19.370Z and last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. The vulnerability is described as CWE-78. Evidence from the CVE record and NVD entry indicates that PraisonAI's SubprocessSandbox feature is vulnerable to a sandbox escape attack. The blocklist for dangerous commands does not include sh or bash as standalone executables, allowing an attacker to execute arbitrary commands using sh -c '<command>'.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.