External risk intelligence

PraisonAI CLI Argument Vulnerability Allows OS Command Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-34935

PraisonAI is a framework for multi-agent systems and CLI tools. While it can be integrated into internet-facing applications or automation pipelines, it is primarily a developer-focused library and toolset. The exposure depends heavily on how a user implements and deploys the framework, and it is not inherently designed as a public-facing network edge service.

OS Command Injection

Praisonai

4.5.15 to before 4.5.69

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in PraisonAI's multi-agent systems could allow unauthorized command execution on affected systems, as the system improperly handles command-line arguments passed to its underlying processes. This could potentially lead to compromise if the software is deployed in a way that allows external input to influence these arguments. The main concern is confirming relevance and exposure.

Command arguments could be misused.
It allows unauthorized system commands.
Assess PraisonAI system impact.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted command-line argument to the PraisonAI system. Because the argument is not validated, it is passed directly to a system command, allowing the attacker to execute arbitrary operating system commands.

No authentication or special access needed.
Specially crafted CLI argument.
Arbitrary OS command execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an attacker could execute arbitrary operating system commands as the process user by providing specially crafted input to the `--mcp` CLI argument. This could affect the integrity and availability of the system, and potentially lead to the compromise of sensitive information.

Arbitrary OS command execution.
Input passed to CLI argument.
System compromise and data exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in PraisonAI affects versions between 4.5.15 and 4.5.69, allowing arbitrary OS command execution. Technical leaders should direct infrastructure and platform teams to first identify all instances of the affected PraisonAI deployment, confirm external reachability and business criticality, and then assign ownership for risk-based remediation planning.

Infrastructure and platform teams own remediation.
Verify external exposure and business criticality.
Plan and execute remediation by owner.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is PraisonAI?

PraisonAI is a framework designed to build and manage multi-agent artificial intelligence systems. It provides CLI tools and libraries that allow developers to coordinate multiple AI agents to perform complex tasks, often within automation pipelines or custom software environments.

What does CWE-78 mean for CVE-2026-34935?

CWE-78 refers to Improper Neutralization of Special Elements used in an OS Command. In this CVE, it means the software fails to sanitize input provided to the --mcp argument. Because the input is passed directly to the system as a command, an attacker can trick the application into executing unauthorized commands on the underlying operating system with the permissions of the user running the process.

How is this vulnerability triggered?

The flaw is triggered when a user or automated process provides a specially crafted input to the --mcp CLI argument. This input bypasses security checks and is passed directly to the system shell. Importantly, simply having the software installed is not enough; the bug only occurs if the system is configured or invoked in a way that allows malicious or untrusted input to be passed into that specific CLI argument.

Is my PraisonAI instance at risk?

Risk depends on your deployment. According to Halo Surface Signal, PraisonAI is primarily a developer-focused toolset, not a public-facing edge service. However, if you have integrated it into applications that accept external input or exposed it through automation pipelines, the risk increases. You should evaluate whether your deployment allows untrusted sources to influence the arguments passed to the system.

Do I need to update PraisonAI?

Yes. If you are using any version between 4.5.15 and 4.5.68, you are affected by this vulnerability. The maintainers have addressed this issue in version 4.5.69. You should identify all deployments in your environment and upgrade to version 4.5.69 or later as soon as possible to prevent arbitrary command execution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.