CVE-2026-34935: 
Python vulnerability analysis and mitigation

CVE-2026-34935 is a critical OS Command Injection vulnerability in PraisonAI, a multi-agent AI framework, affecting the MCPHandler.parse_mcp_command() function. The --mcp CLI argument is passed directly to shlex.split() and forwarded through the call chain to anyio.open_process() with no validation, allowlist check, or sanitization at any hop, enabling arbitrary OS command execution as the process user. Affected versions are 4.5.15 through 4.5.68 (inclusive); the issue was patched in version 4.5.69. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory). The vulnerability was published on March 31, 2026, and reported by security researcher YeranG30 (PraisonAI Advisory).

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The vulnerable call chain flows from cli/features/mcp.py:61 (source), where shlex.split(command) tokenizes the raw --mcp argument, through praisonaiagents/mcp/mcp.py:345 (hop), and finally to mcp/client/stdio/__init__.py:253 (sink), where anyio.open_process([command, *args]) executes the resulting tokens as an OS process — with no validation at any stage (PraisonAI Advisory). Because shlex.split() merely tokenizes shell-like syntax without restricting which executables can be invoked, an attacker can supply any arbitrary binary (e.g., bash, sh, curl) as the first token. The fix in commit 47bff65 introduces ALLOWED_MCP_COMMANDS, an allowlist of permitted executables (npx, uvx, node, python, docker, deno, bun, pipx, and their platform variants), rejecting any command whose basename is not in the set (Patch Commit).

Successful exploitation grants an unauthenticated attacker full OS command execution as the PraisonAI process user, resulting in high confidentiality, integrity, and availability impact (GitHub Advisory). An attacker can read or exfiltrate sensitive files, modify or delete data, install backdoors or persistence mechanisms, and potentially pivot to other systems accessible from the host. Any deployment where the --mcp argument is influenced by untrusted input — such as web-facing wrappers, automation pipelines, or multi-tenant environments — is fully exposed (PraisonAI Advisory).

A public proof-of-concept (PoC) is included in the official security advisory, demonstrating exploitation with a single command: praisonai --mcp "bash -c 'id > /tmp/pwned'" (PraisonAI Advisory). No authentication is required, and attack complexity is low. As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and no threat actor attribution has been made (Feedly). The EPSS score is approximately 0.083% (roughly the 18th percentile), indicating a currently low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Identify a vulnerable deployment: Locate a PraisonAI installation running versions 4.5.15–4.5.68, particularly any environment where the --mcp CLI argument can be influenced by external or untrusted input (e.g., a web API wrapper, automation script, or multi-tenant service).
2. Craft the malicious --mcp payload: Construct a command string where the first token is an arbitrary executable (e.g., bash, sh, curl) followed by desired arguments. Example: bash -c 'id > /tmp/pwned'.
3. Invoke PraisonAI with the payload: Execute praisonai --mcp "bash -c 'id > /tmp/pwned'". The argument is passed to shlex.split(), which tokenizes it into ['bash', '-c', 'id > /tmp/pwned'] without any validation.
4. Trigger OS process execution: The tokenized command flows through parse_mcp_command() and is passed to anyio.open_process(['bash', '-c', 'id > /tmp/pwned']), which spawns the shell command as the PraisonAI process user.
5. Verify and escalate: Confirm execution by checking the output file (cat /tmp/pwned). From here, an attacker can establish a reverse shell, exfiltrate data, or deploy persistence mechanisms (PraisonAI Advisory).

• Process: Unexpected child processes spawned by the PraisonAI process with executables such as bash, sh, curl, wget, or python invoked with -c flags or shell command strings.
• File System: Unexpected files created in world-writable directories (e.g., /tmp/pwned, /tmp/*.sh); new cron jobs, systemd units, or SSH authorized_keys entries created by the PraisonAI service account; web shells or backdoor scripts in accessible directories.
• Network: Outbound connections from the PraisonAI host to unexpected external IP addresses or domains, particularly on non-standard ports (indicative of reverse shell or C2 activity).
• Logs: System or application logs showing PraisonAI invoked with --mcp arguments containing shell keywords (bash, sh, curl, wget, python -c, etc.) or shell metacharacters (;, |, &&, >); audit logs (auditd) recording execve calls for disallowed executables spawned under the PraisonAI process tree.

Upgrade PraisonAI to version 4.5.69 or later, which introduces an executable allowlist (ALLOWED_MCP_COMMANDS) in MCPHandler.parse_mcp_command() that rejects any command not explicitly permitted (Patch Commit). As an interim workaround, restrict CLI access to PraisonAI to trusted, authenticated users only and implement network-level controls (firewalls, access controls) to prevent untrusted input from reaching the --mcp argument. Audit any automation pipelines, web wrappers, or integrations that pass external data to the --mcp flag and sanitize or eliminate such data flows until the patch is applied (PraisonAI Advisory).

The vulnerability was covered by The Hacker Wire, which published an article specifically on the PraisonAI CLI command injection issue (The Hacker Wire). A dev.to post titled "7 CVEs in 48 hours: How PraisonAI got completely owned" highlighted this and related vulnerabilities as a broader pattern of security weaknesses in AI agent frameworks, drawing community attention to the risks of unsanitized subprocess execution in agentic AI tools. Red Hat also tracked the vulnerability in their CVE database (Red Hat). Social media discussion appeared on Bluesky and Mastodon, primarily from security researchers and automated CVE tracking accounts.