CVE-2026-34937 in PraisonAI
要約 (英語)
PraisonAI is a multi-agent teams system. Prior to version 1.5.90, run_python() in praisonai constructs a shell command string by interpolating user-controlled code into python3 -c "" and passing it to subprocess.run(..., shell=True). The escaping logic only handles \ and ", leaving $() and backtick substitutions unescaped, allowing arbitrary OS command execution before Python is invoked. This issue has been patched in version 1.5.90.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
責任者
GitHub_M
予約する
2026年03月31日
公開
2026年04月04日
ステータス
確認済み
エントリ
VulDB provides additional information and datapoints for this CVE:
| 識別子 | 脆弱性 | CWE | 悪用可 | 対策 | CVE |
|---|---|---|---|---|---|
| 355235 | MervinPraison PraisonAI run_python 特権昇格 | 78 | 未定義 | 公式な修正 | CVE-2026-34937 |