External risk intelligence

PraisonAI Sandbox Escape Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-34955

PraisonAI is a framework for multi-agent teams. While it can be integrated into internet-facing applications or API services, it is also frequently used as a local development tool, library, or internal automation utility. Because its deployment pattern varies widely between local environments and public-facing services, internet exposure is plausible but not a default requirement.

OS Command Injection

Praisonai

before 4.5.97

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in PraisonAI's security subprocess handling, specifically within its sandbox feature across all configurations. This flaw could allow unauthorized execution of commands, potentially impacting system integrity and confidentiality. The primary concern is to confirm if PraisonAI is used in a way that exposes this vulnerability.

An important security flaw exists in PraisonAI's sandbox.
Confirms if the system is used in an exploitable way.
Assess PraisonAI usage for potential security risks.

Attack Path

How an attacker could exploit the issue

An attacker could compromise the PraisonAI system by exploiting a weakness in how it handles commands within its sandbox environment. If the PraisonAI system is exposed externally, an unauthenticated attacker could send specially crafted commands that bypass the intended security measures, leading to a complete takeover of the system.

External network access required.
Trivial sandbox escape via command execution.
Full system compromise and data loss.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to escape the sandbox environment of PraisonAI and execute arbitrary commands on the underlying system. This could occur when PraisonAI is configured in STRICT mode and the system is exposed to a network.

Arbitrary command execution.
Sandbox escape via command injection.
System compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

The PraisonAI system's SubprocessSandbox vulnerability requires immediate attention from teams responsible for application security and platform integrity. The first practical step is to identify all deployments of PraisonAI, determine their exposure and criticality, and then confirm ownership to initiate remediation.

Application and platform teams should own.
Verify PraisonAI deployment and reachability.
Plan coordinated vendor and internal remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is PraisonAI?

PraisonAI is a framework designed to manage and coordinate multi-agent teams. It functions as a library or tool that allows users to orchestrate autonomous AI agents to perform tasks. Developers typically integrate it into custom applications for automation, though it is also frequently utilized as a local development utility on individual machines or within internal infrastructure.

What does CVE-2026-34955 mean for the sandbox?

This vulnerability is classified as CWE-78, or OS Command Injection. In affected versions of PraisonAI, the sandbox feature relies on incomplete pattern matching to filter dangerous inputs. Because it does not block specific system shells, an attacker can bypass the sandbox's security boundaries to execute arbitrary system commands, effectively breaking out of the restricted environment the software intended to maintain.

How can an attacker trigger this sandbox escape?

An attacker triggers this by providing specially crafted input that the application processes through the vulnerable SubprocessSandbox. While the sandbox is intended to isolate command execution, the flaw allows the use of common shell executables like 'sh' or 'bash' to bypass filters. Importantly, this escape is not triggered by normal, authorized usage of the tool; it specifically requires the ability to inject malicious command strings that the system then executes.

Is my PraisonAI deployment at risk?

Risk depends on your deployment's visibility. According to Halo Surface Signal, PraisonAI is a flexible tool used in both local development and public-facing services. You are at higher risk if your PraisonAI instance is internet-facing, as this creates a path for unauthenticated network access. Internal, isolated instances face lower immediate risk, but you should still assess whether any part of your architecture exposes this component to untrusted users.

What steps should I take to address this?

Your priority is to identify all instances of PraisonAI running in your environment. Once you have located these deployments, check the version number; the vulnerability affects everything prior to version 4.5.97. If you are running an outdated version, update to 4.5.97 or later immediately to patch the sandbox filtering logic. If an update is not immediately possible, restrict network access to the application as a temporary containment measure.

References

github.com/MervinPraison/PraisonAI/security/advisories/GHSA-r4f2…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.