External risk intelligence

PraisonAI run_python OS Command Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-34937

PraisonAI is a multi-agent framework. While typically used in backend or development workflows, the vulnerability is reachable over the network (AV:N). If a user implements PraisonAI in a web-facing application or API that passes unsanitized input to the affected run_python() function, the system becomes exposed to arbitrary command execution.

OS Command Injection

Praisonaiagents

before 1.5.90

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the PraisonAI system allows attackers to execute arbitrary operating system commands, potentially leading to unauthorized access and control of systems. This critical issue impacts the PraisonAI multi-agent teams framework prior to version 1.5.90.

Allows outside code to run system commands.
Critical flaw, impacts multiple agent systems.
Confirm if PraisonAI is in use and exposed.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this by sending specially crafted input to a PraisonAI system over the network. This input would be processed by the `run_python()` function, which incorrectly constructs a shell command by interpolating user-controlled code. The vulnerability allows for arbitrary operating system command execution before the Python code even runs.

Entry condition: Network access required.
Trigger point: User-controlled code interpolation.
Resulting risk: Arbitrary OS command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to execute arbitrary operating system commands on systems running PraisonAI when it processes user-controlled input. This occurs because user-supplied code is not properly escaped before being used to construct a shell command, enabling command injection.

System commands could be executed remotely.
Unsanitized input may lead to command execution.
Arbitrary code execution on the host.

Operational Fix

Recommended remediation, mitigation, and detection steps

The PraisonAI Agents system is affected by a critical command injection vulnerability. This impacts teams responsible for application development, platform operations, or any group deploying PraisonAI, particularly if it's integrated into network-facing applications. The immediate first step is to identify all instances of the affected software, confirm their exposure and business criticality, and then assign ownership for remediation.

Application owners should manage remediation.
Verify network reachability and criticality.
Plan for vendor-coordinated updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is PraisonAI?

PraisonAI is a framework designed for building multi-agent systems where automated AI agents collaborate to perform tasks. It is commonly used in backend automation, development workflows, or internal logic processing where these autonomous teams operate. The software manages complex agent team interactions, often requiring the ability to execute dynamic code as part of its orchestration capabilities.

How does CVE-2026-34937 work?

This is a command injection vulnerability, classified as CWE-78. The affected run_python() function takes user-provided code and embeds it into a shell command string. Because the escaping mechanism fails to sanitize specific characters like backticks or subshell operators, an attacker can escape the intended Python context to execute arbitrary commands directly on the underlying operating system host.

Can any input trigger this vulnerability?

Not every interaction triggers the flaw. The vulnerability specifically requires the system to process unsanitized, attacker-supplied input within the run_python() function. If the implementation does not pass external or user-provided code into this specific function, or if the input is strictly validated and sanitized before reaching the function, the trigger condition for command injection is not met.

Why is this a risk for my network?

According to Halo Surface Signal, this vulnerability is reachable over the network. While PraisonAI is often used in backend workflows, if your implementation exposes this functionality via a web-facing application or API that accepts untrusted input, the system becomes accessible to remote attackers. Systems that are fully internal and lack pathways for external input have a lower immediate risk profile.

Do I need to update my software?

Yes, if you are running any version of PraisonAI prior to 1.5.90, your system is vulnerable. The first step is to inventory all deployments within your environment to identify where the software is running. Once identified, prioritize updating to version 1.5.90 or later to apply the necessary security patches that fix the command escaping logic.

References

github.com/MervinPraison/PraisonAI/security/advisories/GHSA-w37c…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.