External risk intelligence

PraisonAI Agents Command Execution Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-34938

PraisonAI is a multi-agent framework frequently deployed as a web application or API service to facilitate automated tasks. Because these frameworks are commonly exposed as web-based interfaces or remote API endpoints to interact with agents and execute code, the attack surface is likely to be reachable from the internet in standard deployments.

Praisonaiagents

before 1.5.90

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability in PraisonAI agents allows for unrestricted operating system command execution, potentially impacting systems that handle sensitive data or operations. The issue arises from a flaw in how code execution is sandboxed, enabling attackers to bypass security measures.

Code execution sandbox bypass found.
High impact if PraisonAI is internet-exposed.
Confirm if this system is deployed and relevant.

Attack Path

How an attacker could exploit the issue

An attacker could gain control of the PraisonAI system by sending specially crafted input that bypasses its code execution safeguards. This input targets a function designed to safely handle code, tricking it into allowing arbitrary operating system commands to run on the host machine. This could lead to a complete compromise of the system.

Unauthenticated network access required.
Bypass sandbox through specific input.
Achieve arbitrary OS command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to execute arbitrary operating system commands on the host system. This occurs when a specially crafted string subclass is passed to a wrapper function, bypassing security controls within the PraisonAI multi-agent system.

Arbitrary OS command execution on host.
Bypass of sandbox via string subclass.
Complete compromise of host system.

Operational Fix

Recommended remediation, mitigation, and detection steps

The PraisonAI multi-agent system, specifically the `execute_code()` function in praisonai-agents, is susceptible to arbitrary OS command execution. This critical vulnerability, patched in version 1.5.90, can be exploited through a specially crafted string subclass. Identifying all instances of this software, confirming their accessibility and business criticality, and then assigning an accountable owner are the essential first steps for remediation.

Platform or application owners should manage this issue.
Verify all PraisonAI agent deployments.
Plan and coordinate immediate remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is PraisonAI and its agents component?

PraisonAI is a framework designed for orchestrating multi-agent systems, where autonomous agents work together to complete automated tasks. The praisonai-agents component is specifically responsible for handling the execution of code within these agent workflows. It is often deployed as a web-based service or API endpoint to enable remote interaction with these automated teams.

How does CVE-2026-34938 bypass security?

This vulnerability falls under the weakness class of protection mechanism failures, categorized as CWE-693. The system uses a three-layer sandbox to isolate and safely run Python code. However, the flaw allows an attacker to bypass this boundary by submitting a specially crafted string subclass with an overridden method. This trick circumvents the safe attribute wrapper, allowing the system to inadvertently execute unauthorized operating system commands.

What triggers this command execution bug?

An attacker triggers the vulnerability by sending malicious input that interacts with the execute_code() function. Because the sandbox relies on specific object properties, it is not triggered by standard, safe Python code operations. The compromise occurs specifically when the system processes the manipulated string subclass designed to exploit the wrapper logic, ultimately leading to host-level command execution.

Is my PraisonAI deployment at risk?

According to Halo Surface Signal, this vulnerability is classified as external because PraisonAI instances are frequently deployed as internet-facing web applications or API services. If your PraisonAI agents are reachable from the network, the risk of unauthorized access is higher. You should assess whether your specific implementation exposes agent functionality to untrusted network traffic.

How do I secure my environment against this?

The primary step is to update praisonai-agents to version 1.5.90 or later, which contains the fix for the sandbox bypass. Start by auditing your environment to locate all active deployments of the software. Once identified, coordinate with the system owners to prioritize the update and verify that the patched version is running, ensuring that the sandbox controls are correctly enforced.

References

github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6vh2…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.