by Kastro
Paper/Archive/CVE-2026-34935

CVE-2026-34935

MervinPraison PraisonAI — PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()

EPSS 0.8%public exploitCVSS 9.8
critical.is priorityof 100
51
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 57.8.578 × 2011.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

PraisonAI is a multi-agent teams system. From version 4.5.15 to before version 4.5.69, the --mcp CLI argument is passed directly to shlex.split() and forwarded through the call chain to anyio.open_process() with no validation, allowlist check, or sanitization at any hop, allowing arbitrary OS command execution as the process user. This issue has been patched in version 4.5.69.

Affected

ProductAffectedFixed inSource
PraisonAI>= 4.5.15, < 4.5.69–CNA

Scores by source

GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/MervinPraison/PraisonAI/security/advisories/GHSA-9gm9-c8mq-vq7mrefgithub.com/MervinPraison/PraisonAI/commit/47bff65413beaa3c21bf633c1fae4e684348368c