PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-34955 MervinPraison CVE debrief

A vulnerability was discovered in PraisonAI's SubprocessSandbox feature, which allows for trivial sandbox escape in STRICT mode. The issue arises from the use of subprocess.run() with shell=True and inadequate string-pattern matching to block dangerous commands. Specifically, the blocklist does not include sh or bash as standalone executables, permitting an attacker to execute arbitrary commands using sh -c '<command>'. This vulnerability has been patched in version 4.5.97. The vulnerability's high CVSS score of 8.8 indicates its severity, and the fact that it is exploitable in STRICT mode, which is supposed to provide a higher level of security, makes it particularly concerning for users of PraisonAI versions prior to 4.5.97.

Vendor
MervinPraison
Product
PraisonAI
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-04
Original CVE updated
2026-07-24
Advisory published
2026-04-04
Advisory updated
2026-07-24

Who should care

Users of PraisonAI versions prior to 4.5.97 should be aware of this vulnerability and take immediate action to update their installations. The vulnerability's high CVSS score of 8.8 indicates its severity, and the fact that it is exploitable in STRICT mode, which is supposed to provide a higher level of security, makes it particularly concerning for operators, platforms, vulnerability management teams, and security teams.

Technical summary

The SubprocessSandbox feature in PraisonAI, prior to version 4.5.97, is vulnerable to a sandbox escape attack. This occurs because subprocess.run() is called with shell=True, and the blocklist for dangerous commands does not include sh or bash as standalone executables. Consequently, an attacker can exploit this vulnerability in STRICT mode by using a command like sh -c '<command>'. The CVSS vector for this vulnerability is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating a high level of severity. The vulnerability is described as CWE-78.

Defensive priority

High

Recommended defensive actions

  • Update PraisonAI to version 4.5.97 or later
  • Review and restrict usage of SubprocessSandbox in STRICT mode
  • Implement additional monitoring and logging to detect potential exploitation attempts
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-04-04T00:16:19.370Z and last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. The vulnerability is described as CWE-78. Evidence from the CVE record and NVD entry indicates that PraisonAI's SubprocessSandbox feature is vulnerable to a sandbox escape attack. The blocklist for dangerous commands does not include sh or bash as standalone executables, allowing an attacker to execute arbitrary commands using sh -c '<command>'.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-04T00:16:19.370Z and has not been modified since then. The NVD entry is currently Analyzed.